PatchSiren cyber security CVE debrief

CVE-2026-46117 Linux CVE debrief

A vulnerability in the Linux kernel's RDMA/mana driver allowed user-space applications to trigger a WARN_ON() assertion and subsequent kernel memory corruption. The flaw existed in the mana_ib_create_qp_rss() function, where user-controlled input specifying Work Queues (WQs) sharing the same Completion Queue (CQ) would trigger a warning condition that the code then proceeded past, leading to corruption. The fix replaces the WARN_ON() with an explicit rejection that fails QP creation safely.

Vendor: Linux
Product: Unknown
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-07-21
Advisory published: 2026-05-28
Advisory updated: 2026-07-21

Who should care

Organizations running Linux systems with Microsoft Azure Network Adapter (MANA) RDMA hardware, cloud providers offering RDMA-enabled instances, and enterprises using high-performance computing workloads that rely on kernel RDMA subsystems.

Technical summary

The RDMA/mana driver in the Linux kernel contained a vulnerability in mana_ib_create_qp_rss() where user-space could specify Work Queues sharing the same Completion Queue. This configuration triggered a WARN_ON() assertion that, rather than halting execution, was followed by code that corrupted kernel memory. The vulnerability is user-triggerable through the RDMA uAPI. The resolution removes the WARN_ON() and replaces it with proper validation that rejects the invalid QP configuration, preventing the corruption path.

Defensive priority

medium

Recommended defensive actions

Apply kernel updates containing the fix commits for affected stable branches
Review systems using Microsoft Azure Network Adapter (MANA) RDMA functionality for kernel stability issues
Monitor kernel logs for QP creation failures in RDMA/mana after patching
Validate RDMA application configurations avoid WQ/CQ sharing patterns that previously triggered this condition

Evidence notes

The vulnerability description indicates this was a user-triggerable kernel corruption path in RDMA/mana driver QP creation. The fix commit removes the WARN_ON() and adds proper validation to reject invalid WQ/CQ configurations. Multiple stable kernel branches received backports.

Sources and references

Verified primary and authoritative sources

CVE-2026-46117 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46117

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46117 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46117

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/159f2efabc89d3f931d38f2d35876535d4abf0a3

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/9cc0c6b1ba8cd5c55aef043e1384de0a8b4efa71

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/9ef65af26b2a6738bf15812042e84b3112402d3a

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/db991ba50087ad99fa12a2c483aa3be19671ea73

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.