CVE-2026-46145

Technical summary

The RDMA/mana driver accepts rx_hash_key_len from a user-space API structure without proper bounds validation. This untrusted length value is then used directly in a memcpy operation, enabling a heap or stack buffer overflow within kernel space. The vulnerability is classified as an out-of-bounds write (CWE-787). An attacker with local system access and sufficient privileges to interact with the RDMA interface can supply an arbitrarily large length value, causing memcpy to write beyond allocated buffer boundaries and corrupt adjacent kernel memory.

Business impact

Successful exploitation can result in kernel memory corruption leading to system instability, denial of service, or privilege escalation. An attacker could potentially escalate from a unprivileged local user account to kernel-level code execution, compromising the entire system. For organizations running RDMA-enabled infrastructure—particularly in high-performance computing, data centers, or cloud environments—this vulnerability poses a significant risk to confidentiality, integrity, and availability of affected systems.

Affected systems

The Linux kernel is affected across its various distributions and versions. Any system running a vulnerable kernel version with RDMA/mana driver support and user-space access to RDMA interfaces is at risk. This includes enterprise Linux distributions, cloud platforms, and HPC clusters that rely on RDMA for performance-critical workloads. Organizations should verify which specific kernel versions in their environment contain this vulnerability by cross-referencing their kernel version against Linux kernel security advisories and their distribution's patch schedule.

Exploitability

The vulnerability requires local system access and the ability to make RDMA user-space API calls, limiting the attack surface to authenticated local users. No network-based exploitation is possible. However, the low barrier to crafting a malicious parameter value—simply specifying an oversized length in a user-space structure—makes exploitation straightforward for an attacker with local access. The vulnerability does not require special user privileges beyond the ability to interact with RDMA interfaces, and exploitation is deterministic.

Remediation

Remediation requires applying a kernel patch that adds bounds checking on the rx_hash_key_len parameter before it is used in the memcpy operation. This validates that the length does not exceed the size of the destination buffer. Systems should update to a patched kernel version provided by their Linux distribution. Verify against your vendor's security advisory for specific patched kernel versions applicable to your distribution and release cycle.

Patch guidance

Monitor your Linux distribution's security advisories and kernel update channels for patches addressing CVE-2026-46145. Patches should include explicit bounds validation added to the RDMA/mana driver code. Test patched kernel versions in a non-production environment before rolling out to critical systems, particularly in RDMA-dependent infrastructure. Coordinate kernel updates with scheduled maintenance windows to minimize downtime in high-availability environments.

Detection guidance

Monitor system logs for unexpected kernel errors, memory corruption warnings, or kernel panics on systems with RDMA workloads active. Look for out-of-bounds write warnings from kernel memory protection mechanisms (KASan, KFENCE if enabled). Network-based detection is limited due to the local-only nature of the attack, but behavioral anomalies such as processes gaining unexpected privileges or RDMA daemon crashes may signal exploitation attempts. Review access logs for RDMA driver interface interactions and correlate with timing of system instability.

Why prioritize this

This vulnerability earns HIGH priority due to its local privilege escalation potential, memory corruption capability, and impact on security-critical kernel space. Although it requires local access, the straightforward exploitation method and severe consequences warrant rapid remediation. Organizations running RDMA-enabled systems—particularly in cloud, HPC, or data center environments where multiple tenants or workloads may coexist—should treat this as urgent, as a compromised host can undermine trust across shared infrastructure.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a local attack vector (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L), and no user interaction needed (UI:N). The impact is severe across all three security properties: confidentiality, integrity, and availability are all marked high (C:H/I:H/A:H), indicating that successful exploitation can lead to full compromise of the affected system. The scope is unchanged (S:U), meaning impact is limited to the vulnerable component itself rather than other systems.

Frequently asked questions