Executive brief
A vulnerability in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver could cause a system crash (kernel panic). This occurs when the system attempts to clean up after a failed network interface setup, leading to a 'NULL pointer dereference.' In practice, this could result in a denial-of-service, impacting the availability of cloud-based workloads using this specific network hardware.
Technical details
A NULL pointer dereference exists in the MANA (Microsoft Azure Network Adapter) Ethernet driver (mana_en.c) within the Linux kernel. The issue arises when queue allocation fails during device attachment or MTU changes; the error path frees and nullifies 'apc->tx_qp' and 'apc->rxqs', but subsequent teardown functions like mana_chn_setxdp(), mana_destroy_vport(), mana_fence_rqs(), and mana_dealloc_queues() lack NULL guards before dereferencing these pointers. An attacker or a system error triggering these paths can cause a kernel panic. The fix introduces NULL checks in these specific teardown and recovery functions to ensure they skip processing if queues were never successfully allocated.
Affected products
- Linux Linux Kernel 5.13 to 6.1.176, 6.6.x, 6.12.x
Timeline
- 2026-05-25: disclosed: Initial patch submitted by Microsoft developer
- 2026-06-09: patched: Patch committed to stable kernel tree
- 2026-07-19: advisory: CVE published to NVD
References
- https://git.kernel.org/stable/c/0a9c520fdcb1cb2e79c163c12d359b5e1ee40007
- https://git.kernel.org/stable/c/17bfe0a8c014ee1d542ad352cd6a0a505361664a
- https://git.kernel.org/stable/c/26a96fa81496afe7d162d172ccdc8cb9dbc685d2
- https://git.kernel.org/stable/c/95e414f8324385771bdfd6d497a01d5593813ccb
- https://git.kernel.org/stable/c/da7e4a1aaf397af6a094f640c92d6bc7564c10db
- https://git.kernel.org/stable/c/da87896f34e0a51489811d1a684e2953099ca98f