CVE-2026-63972: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63972 Overview

CVE-2026-63972 is a NULL pointer dereference vulnerability in the Microsoft Azure Network Adapter (MANA) driver of the Linux kernel. The flaw resides in the mana_per_port_queue_reset_work_handler() recovery path. When a previous detach operation succeeds but the subsequent attach fails, the port remains in a detached state with apc->tx_qp and apc->rxqs already freed. A subsequent unconditional call to mana_detach() triggers NULL pointer dereferences during queue teardown, leading to a kernel crash and denial of service.

Critical Impact
Attackers or fault conditions triggering the MANA queue reset path can cause kernel-level denial of service on affected Linux systems running on Azure infrastructure.

Affected Products

Linux kernel (upstream) with the MANA network driver enabled
Linux distributions shipping the net/ethernet/microsoft/mana driver
Azure Linux virtual machines using MANA-based network adapters

Discovery Timeline

2026-07-19 - CVE-2026-63972 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63972

Vulnerability Analysis

The vulnerability affects the Microsoft Azure Network Adapter (MANA) driver in the Linux kernel networking stack. The driver manages transmit queue pairs (tx_qp) and receive queues (rxqs) for each network port. During normal operation, mana_detach() frees these queue structures as part of port teardown, and mana_attach() reallocates them when bringing the port back online.

The defect occurs when the recovery worker mana_per_port_queue_reset_work_handler() executes after an asymmetric state transition. If a prior mana_detach() completes successfully but the follow-up mana_attach() fails, the port ends up in a detached state where netif_device_present() returns false and the queue pointers are already NULL. When the reset handler unconditionally invokes mana_detach() a second time, the teardown logic dereferences the freed tx_qp and rxqs structures.

Root Cause

The root cause is a missing idempotency check in mana_detach(). The function does not verify whether the port has already been detached before proceeding with queue teardown. This is a Null Pointer Dereference [CWE-476] triggered by improper state validation in the driver recovery path.

Attack Vector

The attack vector is network-adjacent through conditions that trigger the MANA queue reset work handler. Any event causing an attach failure after a successful detach places the port into the vulnerable state. A subsequent reset invocation then dereferences NULL pointers within kernel context, resulting in a kernel oops and denial of service. The upstream fix adds an early exit in mana_detach() when the port is already detached for non-close callers, making the function safe to call idempotently. See the kernel commits 5b05aa36, 7ae59079, and c4152b4e for the patch details.

Detection Methods for CVE-2026-63972

Indicators of Compromise

Kernel oops or panic messages referencing mana_detach, mana_per_port_queue_reset_work_handler, or MANA queue teardown functions in dmesg and /var/log/kern.log.
Unexpected network interface loss on Azure VMs using MANA adapters, followed by kernel stack traces citing NULL pointer dereferences in net/ethernet/microsoft/mana.
Repeated MANA driver reset events preceding a system crash or reboot.

Detection Strategies

Monitor kernel ring buffer output for stack traces containing MANA driver symbols and NULL pointer dereference signatures.
Correlate MANA reset work handler invocations with subsequent attach failures in kernel logs.
Track kernel version inventory across the fleet to identify hosts running MANA driver builds that predate the fix commits.

Monitoring Recommendations

Ingest kernel logs into a centralized logging platform and alert on BUG:, Oops:, or Call Trace: entries referencing MANA driver functions.
Baseline expected MANA reset frequency and alert on anomalous spikes that may indicate the pre-crash condition.
Track Azure VM guest health signals and correlate unplanned reboots with kernel crash dumps for post-incident analysis.

How to Mitigate CVE-2026-63972

Immediate Actions Required

Update to a Linux kernel version that includes the fix commits 5b05aa36, 7ae59079, or c4152b4e from the stable tree.
Prioritize patching Azure Linux VMs and any workloads using the MANA network driver.
Enable kernel crash dump collection (kdump) to capture forensic data if the issue triggers before patching completes.

Patch Information

The fix adds an early return in mana_detach() when the port is already in a detached state (!netif_device_present) for non-close callers. This makes the function idempotent and allows the queue reset handler to safely retry mana_attach() without redundant teardown. Apply the upstream patches from kernel.org commit 5b05aa36, commit 7ae59079, and commit c4152b4e, or install vendor-provided kernel updates that backport these changes.

Workarounds

No official workaround exists. Reducing conditions that trigger MANA port reset events may lower exposure but does not eliminate the defect.
Where patching is delayed, ensure automated recovery mechanisms are in place to restore service after a kernel crash on affected hosts.

bash

# Verify installed kernel version and confirm the fix is present
uname -r

# On Debian/Ubuntu systems, upgrade the kernel package
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)

# On RHEL/CentOS/Fedora systems, upgrade the kernel package
sudo dnf update kernel

# Reboot to apply the patched kernel
sudo reboot