CVE-2026-63972 (GCVE-0-2026-63972)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
Title
net: mana: Skip redundant detach on already-detached port
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When mana_per_port_queue_reset_work_handler() runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc->tx_qp and apc->rxqs already freed. Calling mana_detach() again unconditionally leads to NULL pointer dereferences during queue teardown. Add an early exit in mana_detach() when the port is already in detached state (!netif_device_present) for non-close callers, making it safe to call idempotently. This allows the queue reset handler and other recovery paths to simply retry mana_attach() without redundant teardown.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fb9f98e1041a30dd5766620a2a64cb472b54caa9 , < c4152b4e28b3e550ec99351bf900e2c24c2608cc (git)
Affected: 3b194343c25084a8d2fa0c0f2c9e80f3080fd732 , < 7ae590797f9b5c240aaea5773f5f00977a42a846 (git)
Affected: 3b194343c25084a8d2fa0c0f2c9e80f3080fd732 , < 5b05aa36ee24297d7296ca58dfd8c448d0e4cda3 (git)
Affected: 6.18.33 , < 6.18.35 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/mana_en.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c4152b4e28b3e550ec99351bf900e2c24c2608cc",
              "status": "affected",
              "version": "fb9f98e1041a30dd5766620a2a64cb472b54caa9",
              "versionType": "git"
            },
            {
              "lessThan": "7ae590797f9b5c240aaea5773f5f00977a42a846",
              "status": "affected",
              "version": "3b194343c25084a8d2fa0c0f2c9e80f3080fd732",
              "versionType": "git"
            },
            {
              "lessThan": "5b05aa36ee24297d7296ca58dfd8c448d0e4cda3",
              "status": "affected",
              "version": "3b194343c25084a8d2fa0c0f2c9e80f3080fd732",
              "versionType": "git"
            },
            {
              "lessThan": "6.18.35",
              "status": "affected",
              "version": "6.18.33",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/mana_en.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.18.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Skip redundant detach on already-detached port\n\nWhen mana_per_port_queue_reset_work_handler() runs after a previous\ndetach succeeded but attach failed, the port is left in a detached\nstate with apc-\u003etx_qp and apc-\u003erxqs already freed. Calling\nmana_detach() again unconditionally leads to NULL pointer dereferences\nduring queue teardown.\n\nAdd an early exit in mana_detach() when the port is already in\ndetached state (!netif_device_present) for non-close callers, making\nit safe to call idempotently. This allows the queue reset handler and\nother recovery paths to simply retry mana_attach() without redundant\nteardown."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The primary path is mana_tx_timeout() on Azure MANA NICs, triggered by the netdev TX watchdog when queues stall; remote peers on internet-facing VMs can induce TX stalls that schedule the vulnerable mana_detach() recovery workqueue.\nAC:L - An attacker can repeatedly provoke TX watchdog timeouts and control retry timing; while attach failure between cycles may need memory pressure, remote connection floods can contribute and the attacker controls both sides of the reset race.\nPR:N - The TX-timeout recovery path requires no local VM privileges\u2014only network reachability to influence the victim\u0027s MANA interface TX queue behavior and trigger automated driver recovery.\nUI:N - Exploitation is fully automated through the kernel netdev watchdog timer and workqueue handler with no victim user interaction required.\nS:U - Impact is a kernel panic within the same Azure VM guest; the MANA driver runs in guest context and does not cross a VM/host security boundary.\nC:N - The bug is a NULL pointer dereference during redundant queue teardown on already-freed pointers, causing a crash with no information disclosure primitive.\nI:N - There is no data modification or exploitable write primitive; the failure mode is dereferencing NULL tx_qp/rxqs pointers during teardown.\nA:H - The NULL pointer dereference in mana_detach()/mana_dealloc_queues() causes a kernel oops/panic, fully disrupting VM availability on affected Azure instances."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:43.858Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c4152b4e28b3e550ec99351bf900e2c24c2608cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ae590797f9b5c240aaea5773f5f00977a42a846"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b05aa36ee24297d7296ca58dfd8c448d0e4cda3"
        }
      ],
      "title": "net: mana: Skip redundant detach on already-detached port",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63972",
    "datePublished": "2026-07-19T14:55:58.503Z",
    "dateReserved": "2026-07-19T07:54:57.024Z",
    "dateUpdated": "2026-08-05T12:37:43.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63972",
      "date": "2026-09-21",
      "epss": "0.00592",
      "percentile": "0.46719"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/microsoft/mana/mana_en.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c4152b4e28b3e550ec99351bf900e2c24c2608cc",
                    "status": "affected",
                    "version": "fb9f98e1041a30dd5766620a2a64cb472b54caa9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7ae590797f9b5c240aaea5773f5f00977a42a846",
                    "status": "affected",
                    "version": "3b194343c25084a8d2fa0c0f2c9e80f3080fd732",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5b05aa36ee24297d7296ca58dfd8c448d0e4cda3",
                    "status": "affected",
                    "version": "3b194343c25084a8d2fa0c0f2c9e80f3080fd732",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.18.35",
                    "status": "affected",
                    "version": "6.18.33",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/microsoft/mana/mana_en.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Skip redundant detach on already-detached port\n\nWhen mana_per_port_queue_reset_work_handler() runs after a previous\ndetach succeeded but attach failed, the port is left in a detached\nstate with apc-\u003etx_qp and apc-\u003erxqs already freed. Calling\nmana_detach() again unconditionally leads to NULL pointer dereferences\nduring queue teardown.\n\nAdd an early exit in mana_detach() when the port is already in\ndetached state (!netif_device_present) for non-close callers, making\nit safe to call idempotently. This allows the queue reset handler and\nother recovery paths to simply retry mana_attach() without redundant\nteardown."
          }
        ],
        "id": "CVE-2026-63972",
        "lastModified": "2026-07-30T14:51:11.223",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:16.283",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5b05aa36ee24297d7296ca58dfd8c448d0e4cda3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7ae590797f9b5c240aaea5773f5f00977a42a846"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c4152b4e28b3e550ec99351bf900e2c24c2608cc"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-21T16:12:36+00:00",
      "cve": "CVE-2026-63972",
      "id": "CVE-2026-63972",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: mana: Skip redundant detach on already-detached port",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63972.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:45:34Z",
      "cve": "CVE-2026-63972",
      "id": "CVE-2026-63972",
      "initial_release_date": "2026-07-21T13:02:26Z",
      "product_status:first_fixed": "33",
      "product_status:known_affected": "583",
      "product_status:known_not_affected": "167",
      "product_status:recommended": "252",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63972",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63972.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.