CVE-2026-45476: Linux MANA Driver UAF Vulnerability

CVE-2026-45476 Overview

CVE-2026-45476 is a use-after-free vulnerability [CWE-416] in the Linux Microsoft Azure Network Adapter (MANA) driver. The flaw allows an authorized local attacker to elevate privileges on affected systems. Microsoft tracks the issue through its security update guide and has published an advisory for the driver component.

The vulnerability requires local access and high privileges to exploit, but a successful attack changes the security scope and compromises confidentiality, integrity, and availability of the host. Workloads running the MANA driver in Azure-hosted Linux virtual machines are the primary exposure surface.

Critical Impact

A local attacker with privileged access can trigger a use-after-free condition in the Linux MANA driver to escalate privileges and gain control over the affected host.

Affected Products

• Linux MANA Driver (Microsoft Azure Network Adapter driver for Linux)
• Linux virtual machines running on Microsoft Azure that load the MANA driver
• Distributions shipping the upstream MANA Ethernet driver (mana_en)

Discovery Timeline

• 2026-06-09 - CVE-2026-45476 published to NVD
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45476

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the Linux MANA driver. The MANA driver provides network connectivity for Linux guests running on Microsoft Azure's next-generation virtual NIC hardware. A use-after-free occurs when code references memory after it has been released, allowing an attacker to manipulate the freed object before reuse.

When the kernel dereferences a stale pointer to a freed structure, an attacker who controls the contents of the reallocated memory can hijack control flow or corrupt kernel state. In a kernel-mode driver, this leads to local privilege escalation. Because the attack changes the security scope, a compromise of the driver context grants control beyond the attacker's original privilege boundary.

The attack requires local access and existing privileged access on the system. No user interaction is needed. The result is full compromise of confidentiality, integrity, and availability on the affected host.

Root Cause

The root cause is incorrect lifetime management of a kernel object within the MANA driver. A reference to a structure remains in use after the object has been freed, creating a window where attacker-controlled data can occupy the same memory. Subsequent dereferences operate on attacker-controlled content.

Attack Vector

Exploitation requires local access with high privileges on the target Linux system. An authorized attacker triggers driver code paths that release a kernel object while another path still holds a reference to it. The attacker then races to reallocate the freed memory with controlled content, after which the stale reference is used by the driver. See the Microsoft Security Update CVE-2026-45476 advisory for technical details.

Detection Methods for CVE-2026-45476

Indicators of Compromise

• Unexpected kernel oops or panic messages referencing MANA driver symbols (for example mana_en or related function names) in dmesg and /var/log/kern.log.
• Unexplained privilege transitions or new root-owned processes spawned from non-root user sessions on Azure Linux VMs.
• Loading or reloading of the MANA driver module by non-administrative workflows.

Detection Strategies

• Monitor kernel logs for repeated faults, slab corruption warnings, or KASAN reports involving MANA driver code paths.
• Audit setuid, capset, and commit_creds-related activity to identify abnormal credential changes following driver interactions.
• Correlate authenticated local session activity with subsequent kernel-level anomalies on Azure-hosted Linux instances.

Monitoring Recommendations

• Forward kernel and audit logs from Azure Linux VMs to a centralized analytics platform for retention and correlation.
• Track package and kernel version inventory across the Linux fleet to confirm patched builds are deployed.
• Alert on module load events for network drivers outside scheduled maintenance windows.

How to Mitigate CVE-2026-45476

Immediate Actions Required

• Apply the kernel update referenced in the Microsoft Security Update CVE-2026-45476 advisory to all affected Linux systems.
• Inventory Azure Linux VMs that load the MANA driver and prioritize them for patching.
• Restrict local shell access on affected hosts to trusted administrators until updates are deployed.

Patch Information

Microsoft has published guidance and update information for CVE-2026-45476 in the Microsoft Security Update Guide. Administrators should review the Microsoft Security Update CVE-2026-45476 advisory and apply the recommended kernel package versions for their Linux distribution.

Workarounds

• Limit privileged local accounts on Azure Linux VMs to reduce the population of users able to trigger the vulnerable code paths.
• Where networking requirements allow, avoid loading the MANA driver on hosts that do not require the Azure Network Adapter until patches are applied.
• Enforce least-privilege policies and review sudo configurations to minimize the blast radius of a local compromise.