---
id: CVE-2026-46126
title: 'RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()

  Sashiko points out there are two bugs here in the error unwind flow, both
  related to how the WQ…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c15d7802a42402a87880a17eee89ff023e49ecc0 <
    8f23eb6c50f1a4bf32fc4d62cfb9fc39e8e586cf
  - >-
    Linux >= c15d7802a42402a87880a17eee89ff023e49ecc0 <
    bb9cb36eaefa4dcb7c0d9f7a01e5c739abdd53a8
  - >-
    Linux >= c15d7802a42402a87880a17eee89ff023e49ecc0 <
    9a05a6798177e44dfbe18393be2c1ebb89ab06fd
  - >-
    Linux >= c15d7802a42402a87880a17eee89ff023e49ecc0 <
    34ecf795692ee57c393109f4a24ccc313091e137
  - Linux 6.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:09:10.586582Z'
published: '2026-05-28'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:13:38.763Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46126'
references:
  - url: 'https://git.kernel.org/stable/c/8f23eb6c50f1a4bf32fc4d62cfb9fc39e8e586cf'
  - url: 'https://git.kernel.org/stable/c/bb9cb36eaefa4dcb7c0d9f7a01e5c739abdd53a8'
  - url: 'https://git.kernel.org/stable/c/9a05a6798177e44dfbe18393be2c1ebb89ab06fd'
  - url: 'https://git.kernel.org/stable/c/34ecf795692ee57c393109f4a24ccc313091e137'
tags:
  - cve.org
epss: 0.00127
epssPercentile: 0.02427
ingestedAt: '2026-11-06T16:57:43.334Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()

Sashiko points out there are two bugs here in the error unwind flow, both
related to how the WQ table is unwound.

First there is a double i-- on the first failure path due to the while loop
having a i--, remove it.

Second if mana_ib_install_cq_cb() fails then mana_create_wq_obj() is not
undone due to the above i--.

## Affected

- `Linux >= c15d7802a42402a87880a17eee89ff023e49ecc0 < 8f23eb6c50f1a4bf32fc4d62cfb9fc39e8e586cf`
- `Linux >= c15d7802a42402a87880a17eee89ff023e49ecc0 < bb9cb36eaefa4dcb7c0d9f7a01e5c739abdd53a8`
- `Linux >= c15d7802a42402a87880a17eee89ff023e49ecc0 < 9a05a6798177e44dfbe18393be2c1ebb89ab06fd`
- `Linux >= c15d7802a42402a87880a17eee89ff023e49ecc0 < 34ecf795692ee57c393109f4a24ccc313091e137`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.