Linux kernel (drivers/infiniband/hw/mana): The userspace ABI lets a tenant point several work queues at the same

Impact

The userspace ABI lets a tenant point several work queues at the same completion queue, which the driver only flagged with a warning before continuing on to corrupt kernel state. A tenant gets kernel memory corruption from a legal-looking QP creation request rather than a rejection.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Azure MANA node creates an RSS QP whose work queues share one completion queue. No fabric peer or host root required.

What to do

No fixed version is listed in the record - take the stable kernel carrying 9cc0c6b1ba8c (or 9ef65af26b2a / db991ba50087) and reboot. Interim: drop /dev/infiniband/* from untrusted containers on MANA nodes.

References

Related entries

• Linux kernel (drivers/infiniband/hw/mana): The RSS hash-key length arrived from the userspace ABI structure and wentCVE-2026-46145 · Linux kernel (drivers/infiniband/hw/mana)High
• Linux kernel (drivers/infiniband/hw/mlx5): If the second of the two device-wide shared SRQs fails to allocate, theCVE-2026-46176 · Linux kernel (drivers/infiniband/hw/mlx5)High
• Linux kernel RDMA core (ib_umem / IB_MR_REREG_ACCESS re-registration): An RDMA memory region registered read-only canCVE-2026-52908 · Linux kernel RDMA core (ib_umem / IB_MR_REREG_ACCESS re-registration)High
• Linux kernel RDS over InfiniBand (use outside the initial network namespace): The RDS/IB transport was never written toCVE-2026-53077 · Linux kernel RDS over InfiniBand (use outside the initial network namespace)High
• Linux kernel (drivers/infiniband/core): When the IOMMU coalesces a large memory registration into one block spanningCVE-2026-53133 · Linux kernel (drivers/infiniband/core)High
• Linux kernel Soft-RoCE mmap path (rdma_rxe, rxe_mmap vs concurrent DESTROY_CQ): Rxe_mmap() removes the mmap-info objectCVE-2026-64582 · Linux kernel Soft-RoCE mmap path (rdma_rxe, rxe_mmap vs concurrent DESTROY_CQ)High