CVE-2026-43440: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43440 Overview

CVE-2026-43440 is a Linux kernel vulnerability in the Microsoft Azure Network Adapter (MANA) Ethernet driver (net/mana). The flaw exists in the mana_gd_setup() error path, where the driver calls destroy_workqueue() on gc->service_wq but does not reset the pointer to NULL. If mana_gd_cleanup() later inspects the workqueue pointer, it can call destroy_workqueue() a second time on already-freed memory, producing a use-after-free condition. The vulnerability has been resolved upstream through three stable-tree commits.

Critical Impact
A failed MANA device setup can leave a dangling workqueue pointer, enabling a double-destroy that triggers a use-after-free in kernel memory.

Affected Products

Linux kernel — net/mana Ethernet driver (Microsoft Azure Network Adapter)
Stable kernel branches receiving the backported fix commits 59489ce60d74, 6c92392602b4, and 87c2302813ab
Linux guests and hosts deploying MANA virtual network adapters on Azure

Discovery Timeline

2026-05-08 - CVE-2026-43440 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43440

Vulnerability Analysis

The vulnerability resides in the MANA generic driver setup routine mana_gd_setup(). During initialization, the driver allocates a workqueue and stores the reference in gc->service_wq. When a subsequent step in the setup fails, the error-handling path destroys the workqueue using destroy_workqueue(gc->service_wq) but leaves the pointer populated. The cleanup routine mana_gd_cleanup() checks gc->service_wq before destroying it. Because the pointer was not nullified, the cleanup path can invoke destroy_workqueue() on freed memory, producing a use-after-free [CWE-416].

The upstream patch resolves the issue by explicitly setting gc->service_wq = NULL; immediately after the destroy_workqueue() call in the error path, aligning the failure path with the behavior expected by mana_gd_cleanup().

Root Cause

The root cause is inconsistent state management between the setup error path and the cleanup function. The two code paths disagree on whether a destroyed workqueue pointer should remain populated. This asymmetry allows the same workqueue object to be released twice.

Attack Vector

Triggering the flaw requires a failure during MANA device initialization that drives execution into the error path of mana_gd_setup(). Subsequent invocation of the cleanup routine then performs the second destroy_workqueue() call on the freed object. Exploitability depends on whether an unprivileged actor can reliably influence MANA setup failures; no public proof-of-concept exists, and no exploitation has been reported.

No verified code examples are available for this issue. See the upstream commits for the exact source-level changes.

Detection Methods for CVE-2026-43440

Indicators of Compromise

Kernel oops or panic messages referencing destroy_workqueue, mana_gd_cleanup, or mana_gd_setup in dmesg or /var/log/kern.log.
KASAN reports flagging use-after-free in the net/mana driver during device probe or teardown.
Repeated MANA initialization failures followed by abnormal driver unload behavior.

Detection Strategies

Audit running kernel versions across Azure Linux fleets and flag hosts still on pre-patch kernels carrying the MANA driver.
Enable KASAN on test or canary kernels to surface latent use-after-free conditions during MANA probe failures.
Correlate MANA driver error messages with subsequent kernel instability events in centralized logging.

Monitoring Recommendations

Forward kernel ring buffer (dmesg) and journalctl -k output to a centralized log platform for retention and alerting.
Alert on kernel taint events and on workqueue-related backtraces from network driver subsystems.
Track MANA driver load and unload events across Azure-hosted Linux workloads to identify abnormal cycling.

How to Mitigate CVE-2026-43440

Immediate Actions Required

Apply the upstream patches from the Linux stable tree: commits 59489ce60d74, 6c92392602b4, and 87c2302813ab.
Upgrade to a distribution kernel that includes the net/mana fix and reboot affected hosts.
Prioritize Azure-hosted Linux systems and guests using the MANA virtual NIC for patching.

Patch Information

The fix nullifies gc->service_wq in the mana_gd_setup() error path so the cleanup routine cannot perform a second destroy_workqueue() call. Patch references: Kernel Patch 59489ce60d74, Kernel Patch 6c92392602b4, and Kernel Patch 87c2302813ab.

Workarounds

No vendor-supplied workaround replaces the patch; apply the kernel update on the standard maintenance cycle.
Where patching is delayed, avoid configurations that repeatedly trigger MANA setup failures and monitor kernel logs for mana_gd_setup errors.
Restrict local privileged access on affected systems to reduce the chance of an actor inducing repeated driver probe failures.

bash

# Verify the running kernel version and confirm the MANA fix is present
uname -r
grep -E 'mana_gd_setup|service_wq' /proc/kallsyms | head