Executive brief
A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem could allow a local user to cause kernel corruption. By providing specific invalid configurations through the user-facing API, an attacker can trigger internal errors that lead to system instability or crashes. This affects systems using Microsoft Azure Network Adapter (MANA) hardware.
Technical details
A vulnerability in the mana_ib_create_qp_rss() function of the Linux kernel's RDMA driver for Microsoft Azure Network Adapter (MANA) allows for kernel corruption. The issue stems from the uAPI allowing users to specify Work Queues (WQs) that share the same Completion Queue (CQ), which was previously handled by a WARN_ON() macro instead of proper error validation. An attacker can exploit this by providing a crafted configuration through the uAPI, triggering the warning and subsequent memory corruption. The fix replaces the triggerable warning with an explicit check that rejects the QP creation with -EINVAL if a CQ is already assigned in the CQ table.
Affected products
- Linux Linux Kernel Fixed in 159f2efabc89, 9cc0c6b1ba8c, 9ef65af26b2a, db991ba50087
Timeline
- 2026-05-28: advisory: NVD publication date
- 2026-05-02: patched: Initial fix committed to mainline kernel