Junglewise Threat Intelligence

CVE-2026-23454: Linux Kernel MANA driver use-after-free in mana_hwc_destroy_channel

CVE-2026-23454 · Severity: high · CVSS 7 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A security vulnerability has been identified in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver. This flaw occurs during the shutdown process of a network channel, where internal data structures are deleted while the hardware might still be trying to access them. An attacker with local access could exploit this race condition to cause a system crash or potentially execute unauthorized actions, impacting the stability and security of cloud-based virtual machines using this adapter.

Technical details

A use-after-free vulnerability exists in the mana_hwc_destroy_channel() function within the Microsoft Azure Network Adapter (MANA) driver. The root cause is a race condition where 'hwc->caller_ctx' is freed before the Completion Queue (CQ) and Event Queue (EQ) are fully destroyed and their associated IRQs deregistered. Because mana_smc_teardown_hwc() does not synchronize against IRQ handlers executing on other CPUs, an in-flight interrupt handler can dereference the freed memory in mana_hwc_handle_resp(). This can result in a NULL pointer dereference or use-after-free. The fix involves reordering the teardown sequence to ensure queues are destroyed and IRQs are synchronized before freeing the context memory.

Affected products

  • Linux Linux Kernel 5.13 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4

Timeline

  • 2026-03-11: other: Patch authored
  • 2026-04-03: disclosed: CVE published

References

Related threats