CVE-2026-46117: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

Synopsis

This is a kernel memory corruption vulnerability in the Linux kernel's RDMA/mana driver. A local attacker with a low-privilege account can trigger it by passing crafted uAPI input that causes Work Queues to share the same Completion Queue, which hits an unguarded WARN_ON() and then proceeds to corrupt kernel memory. Successful exploitation gives the attacker full read, write, and execution control over the affected system. Patched-image rebuilds at versions 6.12.91, 6.18.30, 7.0.7, and commit 159f2efabc89d3f931d38f2d35876535d4abf0a3 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient to invoke the RDMA uAPI and supply the malicious QP configuration.

• Victim interactionNot required

  No user interaction is needed; the attacker triggers the vulnerability entirely through their own process calls.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental setup beyond having a local account.

Blast Radius

• The attacker reads arbitrary kernel memory, including credentials, session tokens, and secrets held by other processes.
• The attacker writes to arbitrary kernel memory, allowing modification of security policies, process privileges, or persisted data structures.
• The attacker can achieve code execution in kernel context, gaining full control of the host operating system.
• All other workloads sharing the same kernel instance are exposed to tampering or disclosure once kernel memory integrity is lost.