CVE-2026-45476: Linux MANA Driver Use-After-Free Privilege Escalation (Azure)

Technical summary

CVE-2026-45476 is a use-after-free vulnerability (CWE-416) affecting the Microsoft Azure Network Adapter (MANA) driver on Linux. The driver fails to properly manage memory references during specific operations, allowing a privileged local process to reference memory that has been deallocated. By carefully timing operations, an attacker with high privileges (PR:H) can trigger code execution with kernel-level context, achieving privilege escalation and arbitrary code execution with the highest system privileges. The vulnerability has a CVSS v3.1 score of 8.2 (HIGH) and impacts system confidentiality, integrity, and availability.

Business impact

Successful exploitation could allow a high-privilege process—such as a compromised service account, privileged container, or authorized user—to escalate to kernel-level access and fully compromise the affected Azure Linux system. This directly undermines the security isolation that containerized or multi-tenant workloads depend on. Organizations running workloads on Azure Linux instances, particularly those leveraging network-dependent services or confidential computing, face the risk of lateral movement, data exfiltration, or persistent backdoor implantation by an already-privileged insider or compromised application.

Affected systems

The vulnerability affects the Microsoft Azure Network Adapter (MANA) driver on Linux systems. Any Linux system deployed on Azure infrastructure that uses the MANA driver for network connectivity is potentially vulnerable. The scope extends to Azure VMs, container environments, and any Linux workloads relying on the MANA driver for network I/O. Organizations should verify whether their Azure deployments use MANA drivers and confirm the specific versions in use.

Exploitability

Although the CVSS score is 8.2 (HIGH), the practical exploit barrier is moderately elevated because an attacker must already possess high-level system privileges (PR:H). The vulnerability requires no user interaction and the attack vector is purely local, but it is not exploitable by unauthenticated or low-privilege users. The use-after-free condition may require precise timing or specific system state, but once triggered, exploitation is deterministic. This is not listed on the CISA KEV catalog as of publication, meaning no widespread in-the-wild exploitation has been officially tracked, but organizations should not interpret this as evidence of low real-world risk.

Remediation

Obtain and apply the latest MANA driver update from Microsoft Azure. Verify with Microsoft's official security advisory or the Azure documentation to confirm the patched driver version applicable to your Linux distribution and kernel version. Until patching is complete, restrict high-privilege process execution to trusted, regularly audited services, and monitor for anomalous kernel-level process spawning or privilege escalation attempts. In high-security environments, consider isolating affected systems or temporarily shifting workloads to verified patched instances.

Patch guidance

Contact Microsoft Azure support or consult the official security advisory for the specific MANA driver patch version required for your Linux distribution and kernel version. Apply patches to all affected Azure Linux deployments in your environment. Schedule patching during low-risk maintenance windows to minimize service disruption. After patching, validate that the MANA driver is functioning correctly and retest network performance baselines to ensure no unintended side effects.

Detection guidance

Monitor system logs and kernel audit trails for anomalous high-privilege process behavior, particularly unexpected kernel-level execution context changes or privilege escalation events from normally unprivileged processes. Use vulnerability scanning tools to identify systems still running vulnerable MANA driver versions. Implement runtime security monitoring to detect abnormal memory access patterns or process execution anomalies that could indicate exploitation attempts. Organizations using EDR or XDR solutions should configure rules to flag suspicious privilege escalation or kernel-mode code execution on Linux systems.

Why prioritize this

Assign this vulnerability high priority if you operate Azure Linux workloads, particularly in multi-tenant or confidential computing scenarios where security isolation is critical. The 8.2 CVSS score, combined with complete system compromise impact and the high-privilege requirement (which limits but does not eliminate real-world risk in containerized or service-oriented environments), warrants swift remediation. Although not yet on the KEV catalog, the direct path to kernel-level code execution and the broad deployment of Azure infrastructure make this a strong candidate for rapid attacker attention and weaponization.

Risk score, explained

The CVSS 8.2 (HIGH) rating reflects the vulnerability's potential for complete system compromise (high confidentiality, integrity, and availability impact) via a local, no-interaction attack vector. The high-privilege requirement (PR:H) prevents unauthenticated or low-privilege users from exploiting it, but does not materially reduce risk in environments where service accounts, container orchestration systems, or legitimate high-privilege processes may be compromised. The 'Scope Changed' (S:C) component indicates that successful exploitation can affect resources beyond the vulnerable component's security scope, justifying the elevated score.

Frequently asked questions