CVE-2026-53324: Linux MANA Driver Kernel Crash

Technical summary

CVE-2026-53324 is a NULL pointer dereference vulnerability in the Linux kernel's MANA network driver (net/ethernet/microsoft/mana). The root cause lies in the per-device debugfs directory naming logic. For physical functions (PFs), the code hardcoded the directory name as "0"; for virtual functions (VFs), it called pci_slot_name(pdev->slot) without null-checking pdev->slot. In many hypervisor configurations and nested virtualization scenarios, pdev->slot is NULL, causing a kernel dereference. Additionally, the hardcoded "0" approach creates collisions when multiple PFs are present, and pci_slot_name() can produce identical names for VFs across different PCI domains or buses. The fix replaces both approaches with pci_name(pdev), which returns a globally unique Bus:Device.Function (BDF) address that is always valid and guaranteed unique across the system.

Business impact

This vulnerability can cause unplanned system downtime in cloud environments and virtualized deployments that rely on the MANA driver. The crash occurs during device initialization or when the driver accesses debugfs, potentially affecting Azure cloud instances and on-premises hypervisor deployments using MANA NICs. While the impact is localized to availability (the crash prevents the affected network adapter from functioning), it can interrupt service and require system restart. Organizations running MANA-dependent infrastructure in nested KVM or VFIO passthrough configurations face elevated risk.

Affected systems

This vulnerability affects the Linux kernel with the MANA (Microsoft Azure Network Adapter) driver enabled. Primary targets include: Azure virtual machines using MANA NICs, Linux systems with VFIO-based device passthrough in hypervisor environments, nested KVM deployments, and any on-premises Linux infrastructure using MANA network adapters. The bug is triggered during driver initialization, so the vulnerability materializes immediately when a MANA device is brought up on an affected kernel version.

Exploitability

The vulnerability requires local access to trigger (the CVSS vector indicates local attack vector and low privilege requirement). An unprivileged user cannot directly exploit this, but any driver initialization event—such as a VM start, device hotplug, or udev rule that loads the MANA driver—can cause the kernel to crash if the naming collision or NULL dereference occurs. This is not a remote code execution pathway, but rather a denial-of-service condition that takes the network adapter offline and may crash the kernel itself.

Remediation

Apply a Linux kernel update that includes the fix to use pci_name(pdev) for debugfs directory naming in the MANA driver. Verify the fix is present in your kernel version through the Linux kernel git history or your distribution's security advisory. For systems that cannot immediately patch, the MANA driver can be disabled via kernel command-line parameters (intel_iommu=off or similar, depending on your hypervisor), though this removes the network adapter's functionality. Ensure your hypervisor and guest kernel versions are compatible and neither is in a nested virtualization configuration known to cause pdev->slot to be NULL.

Patch guidance

Patches are available in the upstream Linux kernel; verify the commit that resolves CVE-2026-53324 against the official Linux kernel repository (kernel.org). Distributions such as Red Hat, Debian, Ubuntu, and others will release kernel updates that backport this fix. Check your vendor's security advisory for the specific patched kernel version (e.g., verify against RHSA, DSA, or USN listings). Apply the update during your next scheduled maintenance window; the fix is low-risk and does not require configuration changes.

Detection guidance

Monitor kernel logs for debugfs errors and NULL pointer dereference messages related to the MANA driver (look for stack traces containing mana or debugfs_create_dir). On affected systems, the error may appear as "debugfs: cannot create directory" followed by -EEXIST or a kernel panic/oops. Test your environment by booting a test VM with MANA networking enabled on the current kernel version; a successful boot without kernel errors indicates the system is unaffected. Use kernel debugging tools (kdump, netconsole) to capture panic information if the crash occurs.

Why prioritize this

This medium-severity vulnerability (CVSS 5.5) should be prioritized for patching in environments that use MANA drivers, particularly cloud and virtualized deployments. The vulnerability is not in the CISA KEV catalog and is not known to be weaponized, but it has a low attack complexity and affects availability in a targeted use case. Organizations running on Azure or with MANA-dependent infrastructure should treat this as routine maintenance priority; others can include it in their standard patching cadence.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: local attack vector (only accessible on the system itself), low privilege requirement (driver initialization or user-level device operations), no user interaction needed, and high impact on availability (system crash). The vulnerability does not compromise confidentiality or integrity, which keeps the score in the medium range. The actual risk in your environment depends on whether MANA drivers are deployed and whether your hypervisor configuration triggers the NULL pointer path.

Frequently asked questions