CVE-2026-46117

What it actually does

This is a local Linux kernel memory-corruption vulnerability in the RDMA MANA InfiniBand driver. A privileged local user with access to RDMA user-space APIs can request creation of an RSS queue pair with work queues that share the same completion queue. The vulnerable kernel path reaches a user-triggerable WARN_ON() in mana_ib_create_qp_rss() and then continues execution in an unsafe state, allowing kernel memory corruption. Because exploitation occurs in kernel context, successful abuse can affect confidentiality, integrity, and availability, including possible local privilege escalation, kernel crash, or system compromise depending on kernel configuration and exploit reliability.

Why it matters to the business

Systems running affected Linux kernels with the MANA RDMA driver exposed to local users or workloads are at risk of a local user or compromised process escalating privileges or destabilizing the host. The highest business risk is on multi-user, virtualized, HPC, cloud, or container-host systems where untrusted or semi-trusted workloads may have access to RDMA devices. Although the EPSS score is currently low and there is no known KEV listing or reported ransomware use, the CVSS score is high because kernel memory corruption can lead to full host compromise once an attacker has local access.

How an attack unfolds

An attacker first needs local code execution or an account on a system using the affected Linux kernel and MANA RDMA stack. The attacker then interacts with the RDMA verbs interface exposed by the mana_ib driver and submits a crafted queue pair creation request for RSS. In the vulnerable implementation, the attacker can specify work queues that share the same completion queue, which is accepted far enough into processing to trigger a WARN_ON() in mana_ib_create_qp_rss(). Instead of cleanly rejecting the invalid configuration, the kernel continues and can corrupt memory. A working exploit would shape the corrupted kernel state to crash the host or potentially gain elevated privileges. No public exploit maturity is currently reported, but local kernel memory-corruption flaws are commonly valuable as post-compromise privilege-escalation primitives.

How to fix it

Upgrade affected Linux kernels to a vendor release that includes the RDMA/mana fix which rejects RSS queue pair creation when work queues share the same completion queue. No exact fixed package versions were provided, so use the latest security-supported kernel from the relevant Linux distribution, cloud image, or appliance vendor and verify that the patch for mana_ib_create_qp_rss() is included. Reboot systems after kernel updates. As interim mitigation, restrict access to RDMA devices and user-space RDMA interfaces to trusted users only, remove unnecessary RDMA permissions from containers and workloads, unload or blacklist the mana_ib module where MANA RDMA is not required, and disable RDMA functionality if operationally acceptable.

How to confirm the fix worked

Confirm the running kernel is a vendor-fixed build, not only that the package is installed. Validate with uname -r, package manager metadata, and vendor advisories or changelog entries referencing the RDMA/mana fix for mana_ib_create_qp_rss(). Check whether the mana_ib module is loaded with lsmod or /sys/module/mana_ib. Confirm RDMA devices and permissions with rdma link, ibv_devices, and device node permissions under /dev/infiniband. For mitigation validation, ensure untrusted users and containers cannot access RDMA character devices and that mana_ib is not loaded on systems where it is not needed. If testing in a controlled non-production environment, invalid queue pair configurations should be rejected cleanly rather than producing kernel WARN, oops, or crash output.

Typical attack path

1. Gain local execution on an affected Linux system through a valid account, compromised service, container escape prerequisite, or other foothold.
2. Confirm RDMA/MANA device access is available to the user or process.
3. Use RDMA user-space APIs to issue a crafted RSS queue pair creation request through the mana_ib driver.
4. Set work queues in the request so they share the same completion queue.
5. Trigger the vulnerable mana_ib_create_qp_rss() path, causing the kernel WARN_ON() and subsequent unsafe execution.
6. Leverage the resulting kernel memory corruption for denial of service or attempt privilege escalation to gain kernel-level control.

How to detect it

Retrospective detection should focus on kernel telemetry and RDMA activity because exploitation is local and may not leave network indicators. Review journald, syslog, dmesg, kernel ring buffer captures, crash dumps, kdump/vmcore artifacts, and EDR telemetry for WARN, oops, panic, or call traces involving mana_ib_create_qp_rss(), mana_ib, RDMA/mana, or queue pair creation. Correlate any such events with local user sessions, container workloads, batch jobs, sudo activity, process execution, and access to /dev/infiniband device nodes around the same time. On systems with auditd or eBPF-based monitoring, look for processes opening RDMA device files such as /dev/infiniband/uverbs* shortly before kernel warnings or crashes. Because no public exploit or malware indicators are known, absence of these strings does not prove non-exploitation; prioritize anomalous kernel crashes and repeated RDMA queue-pair creation failures from untrusted workloads.

• mana_ib_create_qp_rss
• RDMA/mana
• mana_ib
• WARNING
• WARN_ON
• kernel BUG
• Oops
• Call Trace
• Kernel panic
• /dev/infiniband/uverbs
• /dev/infiniband/rdma_cm
• /sys/module/mana_ib
• ib_uverbs
• rdma_ucm

What your security team should do

• Prioritize patching Linux systems that load the mana_ib driver and allow local users, containers, HPC jobs, or application workloads to access RDMA devices.
• Inventory exposure by identifying hosts with MANA/RDMA hardware, loaded mana_ib modules, and /dev/infiniband access granted to non-administrative users or workloads.
• Apply vendor-supported kernel updates and reboot into the fixed kernel; track systems that have installed but not yet booted the patched kernel.
• Until patched, restrict /dev/infiniband permissions, remove RDMA device passthrough from untrusted containers or virtualized workloads, and unload or blacklist mana_ib where RDMA is unnecessary.
• Monitor kernel logs for mana_ib_create_qp_rss(), WARN_ON, oops, BUG, panic, or RDMA-related crashes, especially on shared compute or cloud hosts.
• Treat suspicious kernel warnings or crashes in the mana_ib path as potential exploitation attempts and preserve logs, kernel crash dumps, and workload attribution data for investigation.