Database/Firmware, BMC & network fabric
Linux kernel (drivers/infiniband/hw/mana): The RSS hash-key length arrived from the userspace ABI structure and went
Impact
The RSS hash-key length arrived from the userspace ABI structure and went straight into a memcpy with no bounds check, so a tenant chooses how many bytes the kernel copies into a fixed destination. That is an attacker-controlled kernel heap overwrite - the cleanest container-to-host escalation shape in this batch.
Who can reach it
A tenant container holding /dev/infiniband/uverbs* on an Azure MANA node creates an RSS QP with an oversized rx_hash_key_len. No fabric peer, no host root, single syscall.
What to do
No fixed version is listed in the record - take the stable kernel carrying 7d7c9f0fcd19 (or 11c1431d641e / 012796f9541f) and reboot. Interim: remove /dev/infiniband/* from untrusted containers on MANA nodes.
References
Related entries
- Linux kernel (drivers/infiniband/hw/mana): The userspace ABI lets a tenant point several work queues at the sameCVE-2026-46117 · Linux kernel (drivers/infiniband/hw/mana)High
- Linux kernel (drivers/infiniband/hw/mlx5): If the second of the two device-wide shared SRQs fails to allocate, theCVE-2026-46176 · Linux kernel (drivers/infiniband/hw/mlx5)High
- Linux kernel RDMA core (ib_umem / IB_MR_REREG_ACCESS re-registration): An RDMA memory region registered read-only canCVE-2026-52908 · Linux kernel RDMA core (ib_umem / IB_MR_REREG_ACCESS re-registration)High
- Linux kernel RDS over InfiniBand (use outside the initial network namespace): The RDS/IB transport was never written toCVE-2026-53077 · Linux kernel RDS over InfiniBand (use outside the initial network namespace)High
- Linux kernel (drivers/infiniband/core): When the IOMMU coalesces a large memory registration into one block spanningCVE-2026-53133 · Linux kernel (drivers/infiniband/core)High
- Linux kernel Soft-RoCE mmap path (rdma_rxe, rxe_mmap vs concurrent DESTROY_CQ): Rxe_mmap() removes the mmap-info objectCVE-2026-64582 · Linux kernel Soft-RoCE mmap path (rdma_rxe, rxe_mmap vs concurrent DESTROY_CQ)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.