Linux kernel (drivers/infiniband/hw/mana): The RSS hash-key length arrived from the userspace ABI structure and went

CVE-2026-46145Firmware, BMC & network fabriccurated

Impact

The RSS hash-key length arrived from the userspace ABI structure and went straight into a memcpy with no bounds check, so a tenant chooses how many bytes the kernel copies into a fixed destination. That is an attacker-controlled kernel heap overwrite - the cleanest container-to-host escalation shape in this batch.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Azure MANA node creates an RSS QP with an oversized rx_hash_key_len. No fabric peer, no host root, single syscall.

What to do

No fixed version is listed in the record - take the stable kernel carrying 7d7c9f0fcd19 (or 11c1431d641e / 012796f9541f) and reboot. Interim: remove /dev/infiniband/* from untrusted containers on MANA nodes.

References

https://git.kernel.org/stable/c/7d7c9f0fcd19c4d2f0164347c58d49cafa961b72 https://git.kernel.org/stable/c/11c1431d641e0e4e0529e96957995820600c7287 https://nvd.nist.gov/vuln/detail/CVE-2026-46145

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.