Linux kernel (drivers/infiniband/hw/mana): The userspace ABI lets a tenant point several work queues at the same

CVE-2026-46117Firmware, BMC & network fabriccurated

Impact

The userspace ABI lets a tenant point several work queues at the same completion queue, which the driver only flagged with a warning before continuing on to corrupt kernel state. A tenant gets kernel memory corruption from a legal-looking QP creation request rather than a rejection.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Azure MANA node creates an RSS QP whose work queues share one completion queue. No fabric peer or host root required.

What to do

No fixed version is listed in the record - take the stable kernel carrying 9cc0c6b1ba8c (or 9ef65af26b2a / db991ba50087) and reboot. Interim: drop /dev/infiniband/* from untrusted containers on MANA nodes.

References

https://git.kernel.org/stable/c/9cc0c6b1ba8cd5c55aef043e1384de0a8b4efa71 https://git.kernel.org/stable/c/9ef65af26b2a6738bf15812042e84b3112402d3a https://nvd.nist.gov/vuln/detail/CVE-2026-46117

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.