CVE-2026-63972 (GCVE-0-2026-63972)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
EPSS
VEX
Title
net: mana: Skip redundant detach on already-detached port
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: mana: Skip redundant detach on already-detached port
When mana_per_port_queue_reset_work_handler() runs after a previous
detach succeeded but attach failed, the port is left in a detached
state with apc->tx_qp and apc->rxqs already freed. Calling
mana_detach() again unconditionally leads to NULL pointer dereferences
during queue teardown.
Add an early exit in mana_detach() when the port is already in
detached state (!netif_device_present) for non-close callers, making
it safe to call idempotently. This allows the queue reset handler and
other recovery paths to simply retry mana_attach() without redundant
teardown.
Severity
7.5 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
fb9f98e1041a30dd5766620a2a64cb472b54caa9 , < c4152b4e28b3e550ec99351bf900e2c24c2608cc
(git)
Affected: 3b194343c25084a8d2fa0c0f2c9e80f3080fd732 , < 7ae590797f9b5c240aaea5773f5f00977a42a846 (git) Affected: 3b194343c25084a8d2fa0c0f2c9e80f3080fd732 , < 5b05aa36ee24297d7296ca58dfd8c448d0e4cda3 (git) Affected: 6.18.33 , < 6.18.35 (semver) |
guessed | |
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/microsoft/mana/mana_en.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c4152b4e28b3e550ec99351bf900e2c24c2608cc",
"status": "affected",
"version": "fb9f98e1041a30dd5766620a2a64cb472b54caa9",
"versionType": "git"
},
{
"lessThan": "7ae590797f9b5c240aaea5773f5f00977a42a846",
"status": "affected",
"version": "3b194343c25084a8d2fa0c0f2c9e80f3080fd732",
"versionType": "git"
},
{
"lessThan": "5b05aa36ee24297d7296ca58dfd8c448d0e4cda3",
"status": "affected",
"version": "3b194343c25084a8d2fa0c0f2c9e80f3080fd732",
"versionType": "git"
},
{
"lessThan": "6.18.35",
"status": "affected",
"version": "6.18.33",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/microsoft/mana/mana_en.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.18.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Skip redundant detach on already-detached port\n\nWhen mana_per_port_queue_reset_work_handler() runs after a previous\ndetach succeeded but attach failed, the port is left in a detached\nstate with apc-\u003etx_qp and apc-\u003erxqs already freed. Calling\nmana_detach() again unconditionally leads to NULL pointer dereferences\nduring queue teardown.\n\nAdd an early exit in mana_detach() when the port is already in\ndetached state (!netif_device_present) for non-close callers, making\nit safe to call idempotently. This allows the queue reset handler and\nother recovery paths to simply retry mana_attach() without redundant\nteardown."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The primary path is mana_tx_timeout() on Azure MANA NICs, triggered by the netdev TX watchdog when queues stall; remote peers on internet-facing VMs can induce TX stalls that schedule the vulnerable mana_detach() recovery workqueue.\nAC:L - An attacker can repeatedly provoke TX watchdog timeouts and control retry timing; while attach failure between cycles may need memory pressure, remote connection floods can contribute and the attacker controls both sides of the reset race.\nPR:N - The TX-timeout recovery path requires no local VM privileges\u2014only network reachability to influence the victim\u0027s MANA interface TX queue behavior and trigger automated driver recovery.\nUI:N - Exploitation is fully automated through the kernel netdev watchdog timer and workqueue handler with no victim user interaction required.\nS:U - Impact is a kernel panic within the same Azure VM guest; the MANA driver runs in guest context and does not cross a VM/host security boundary.\nC:N - The bug is a NULL pointer dereference during redundant queue teardown on already-freed pointers, causing a crash with no information disclosure primitive.\nI:N - There is no data modification or exploitable write primitive; the failure mode is dereferencing NULL tx_qp/rxqs pointers during teardown.\nA:H - The NULL pointer dereference in mana_detach()/mana_dealloc_queues() causes a kernel oops/panic, fully disrupting VM availability on affected Azure instances."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:43.858Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c4152b4e28b3e550ec99351bf900e2c24c2608cc"
},
{
"url": "https://git.kernel.org/stable/c/7ae590797f9b5c240aaea5773f5f00977a42a846"
},
{
"url": "https://git.kernel.org/stable/c/5b05aa36ee24297d7296ca58dfd8c448d0e4cda3"
}
],
"title": "net: mana: Skip redundant detach on already-detached port",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63972",
"datePublished": "2026-07-19T14:55:58.503Z",
"dateReserved": "2026-07-19T07:54:57.024Z",
"dateUpdated": "2026-08-05T12:37:43.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-63972",
"date": "2026-10-22",
"epss": "0.00592",
"percentile": "0.47589"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/microsoft/mana/mana_en.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c4152b4e28b3e550ec99351bf900e2c24c2608cc",
"status": "affected",
"version": "fb9f98e1041a30dd5766620a2a64cb472b54caa9",
"versionType": "git"
},
{
"lessThan": "7ae590797f9b5c240aaea5773f5f00977a42a846",
"status": "affected",
"version": "3b194343c25084a8d2fa0c0f2c9e80f3080fd732",
"versionType": "git"
},
{
"lessThan": "5b05aa36ee24297d7296ca58dfd8c448d0e4cda3",
"status": "affected",
"version": "3b194343c25084a8d2fa0c0f2c9e80f3080fd732",
"versionType": "git"
},
{
"lessThan": "6.18.35",
"status": "affected",
"version": "6.18.33",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/microsoft/mana/mana_en.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9CA0794D-D2B6-4D31-B5DB-30331CF0D9D7",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.18.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "928FFB59-94A1-4243-84F6-B3700D2F3B6E",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
"matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Skip redundant detach on already-detached port\n\nWhen mana_per_port_queue_reset_work_handler() runs after a previous\ndetach succeeded but attach failed, the port is left in a detached\nstate with apc-\u003etx_qp and apc-\u003erxqs already freed. Calling\nmana_detach() again unconditionally leads to NULL pointer dereferences\nduring queue teardown.\n\nAdd an early exit in mana_detach() when the port is already in\ndetached state (!netif_device_present) for non-close callers, making\nit safe to call idempotently. This allows the queue reset handler and\nother recovery paths to simply retry mana_attach() without redundant\nteardown."
}
],
"id": "CVE-2026-63972",
"lastModified": "2026-10-02T19:41:02.587",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-07-19T16:17:16.283",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/5b05aa36ee24297d7296ca58dfd8c448d0e4cda3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/7ae590797f9b5c240aaea5773f5f00977a42a846"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/c4152b4e28b3e550ec99351bf900e2c24c2608cc"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-19T23:34:52+00:00",
"cve": "CVE-2026-63972",
"id": "CVE-2026-63972",
"initial_release_date": "2026-07-19T00:00:00+00:00",
"product_status:known_not_affected": "275",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: net: mana: Skip redundant detach on already-detached port",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63972.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.