Executive brief
The Microsoft Azure Network Adapter (MANA) driver in the Linux kernel failed to validate packet length values reported by the network interface card before processing them. A malicious or compromised NIC device could report oversized packets, causing memory corruption or denial of service in the kernel's networking stack, potentially allowing arbitrary code execution or system crashes.
Technical details
The vulnerability is an input validation flaw in the MANA network driver's receive path (mana_process_rx_cqe). The driver processes RX completion queue entries (CQEs) supplied by the NIC hardware without validating that the packet length field does not exceed the allocated buffer size (datasize). An attacker with control over the NIC device—either through a compromised firmware update, supply chain attack, or adjacent network access in cloud environments—can craft a malicious CQE with an oversized packet length, triggering out-of-bounds memory access when the driver attempts to process the packet via skb operations. This results in kernel memory corruption leading to denial of service or potential remote code execution. The fix adds a length validation check before skb processing and drops oversized packets with appropriate error logging.
Affected products
- Linux Linux kernel versions containing mana driver (Linux 5.15+)
Timeline
- 2026-08-15: disclosed
- 2026-07-01: patched: Fix commit authored