Executive brief
A vulnerability was identified in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver. A local user could provide a specially crafted input that causes the system to overwrite its own internal memory. This could lead to a system crash or potentially allow an attacker to gain unauthorized control over the operating system.
Technical details
A heap-based buffer overflow exists in the RDMA/mana driver (specifically within mana_ib_cfg_vport_steering in drivers/infiniband/hw/mana/qp.c). The variable 'rx_hash_key_len' is sourced from a userspace API (uAPI) structure and used as a length argument in a memcpy operation without prior bounds checking. A local attacker with access to the RDMA interface can provide an oversized length value to overwrite adjacent kernel memory. The vulnerability has been addressed by adding a check to ensure 'rx_hash_key_len' does not exceed the size of the destination 'hashkey' buffer.
Affected products
- Linux Linux Kernel Versions including RDMA/mana driver before fix
Timeline
- 2026-04-28: other: Patch authored by Jason Gunthorpe
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/012796f9541fcd0c1fa8ae4da7eb4d83931ef838
- https://git.kernel.org/stable/c/11c1431d641e0e4e0529e96957995820600c7287
- https://git.kernel.org/stable/c/6dd2d4ad9c8429523b1c220c5132bd551c006425
- https://git.kernel.org/stable/c/7d7c9f0fcd19c4d2f0164347c58d49cafa961b72
- https://git.kernel.org/stable/c/7d94f155f354b961c598f71bafa804dceded513f