CVE-2026-46145: RDMA/mana: Validate rx_hash_key_len

Synopsis

A heap/stack memory-corruption vulnerability exists in the Linux kernel's RDMA/mana driver due to a missing bounds check on the user-supplied rx_hash_key_len field. The flaw is reached locally and requires a low-privilege account; no network access or victim interaction is needed. Successful exploitation gives an attacker full read, write, and crash capabilities over kernel memory, enabling privilege escalation, data disclosure, or denial of service. Patched-image rebuilds at versions 6.6.141 and 6.12.88 (and the corresponding upstream commits) are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable uAPI path; no administrative credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker exercises the vulnerable code path directly.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or specific memory-layout prerequisites required.

Blast Radius

• Reads arbitrary kernel memory, exposing credentials, cryptographic keys, and sensitive process data belonging to any user or kernel subsystem.
• Writes arbitrary kernel memory, allowing an attacker to overwrite security-critical structures and escalate to root or bypass kernel integrity protections.
• Crashes the kernel or the affected RDMA/mana driver, causing an immediate system reboot or persistent denial of service for all workloads on the host.
• Corrupts kernel state in ways that may persist across driver reloads, potentially leaving the system in an exploitable or unstable condition.