CVE-2026-46117

HighCVSS 7.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WARN_ON() then go on to corrupt the kernel.

Just reject it outright and fail the QP creation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-617CWE-20CWE-1288

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= c15d7802a42402a87880a17eee89ff023e49ecc0, < 9cc0c6b1ba8cd5c55aef043e1384de0a8b4efa71; >= c15d7802a42402a87880a17eee89ff023e49ecc0, < 9ef65af26b2a6738bf15812042e84b3112402d3a; >= c15d7802a42402a87880a17eee89ff023e49ecc0, < db991ba50087ad99fa12a2c483aa3be19671ea73; >= c15d7802a42402a87880a17eee89ff023e49ecc0, < 159f2efabc89d3f931d38f2d35876535d4abf0a3
LinuxLinux6.8
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 9—

References

Timeline

Published
May 28, 2026
Last modified
Oct 19, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-461185.5In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handlCVE-2026-461199.1In the Linux kernel, the following vulnerability has been resolved: libceph: Fix slab-out-of-bounds access in auth message processing If aCVE-2026-46127.3A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the file /hotel/admin/mod_CVE-2026-461207.8In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e7CVE-2026-461217.8In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_locCVE-2026-461227.8In the Linux kernel, the following vulnerability has been resolved: wifi: b43: enforce bounds check on firmware key index in b43_rx() The CVE-2026-461237.7In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: clamp rx length before skb_put virtbt_rx_work() CVE-2026-461247.5In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file handle in isofs_export_iget CVE-2026-461258.8In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection CVE-2026-461265.5In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()CVE-2026-461275.5In the Linux kernel, the following vulnerability has been resolved: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() CVE-2026-461285.5In the Linux kernel, the following vulnerability has been resolved: ipmi: Check event message buffer response for bad data The event messa
CVE-2026-46117: High severity, CVSS 7.8 | Vulnix