Executive brief
A vulnerability was identified in the Linux kernel's RDMA driver for Microsoft Azure Network Adapters (MANA). The issue involves incorrect error handling during the creation of network queues, which could lead to improper resource cleanup if a failure occurs. While primarily a stability issue, such flaws in kernel drivers can sometimes be leveraged to cause system crashes or other unpredictable behavior.
Technical details
A vulnerability exists in the RDMA/mana driver within the Linux kernel, specifically in the mana_ib_create_qp_rss() function. The issue stems from two bugs in the error unwind flow: a double decrement of an index variable ('i--') and a failure to call mana_destroy_wq_obj() when mana_ib_install_cq_cb() fails. These logic errors result in an incorrect cleanup of the Work Queue (WQ) table. An attacker with local access might potentially exploit this improper state management, though the primary impact is kernel stability and resource leaks during specific hardware initialization failures. Patches have been released across various stable kernel branches to correct the unwind logic.
Affected products
- Linux Linux Kernel RDMA/mana driver
Timeline
- 2026-04-28: other: Patch authored
- 2026-05-28: disclosed: CVE published