HIGH Introduced in 6.18
mana XdpProg UAF
CVE-2026-97955
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: net: mana: restore the XDP program pointer when pre-allocation fails mana_xdp_set() publishes the new program into apc->bpf_prog before it allocates anything, because mana_pre_alloc_rxbufs() sizes the buffers from it via mana_get_rxbuf_cfg(). When that allocation fails the function returns the error directly, skipping the err_dealloc_rxbuffs label which is the only place that restores the previous pointer. The attach is reported as failed, so the BPF core drops the reference it held for the caller and the program can be freed, while apc->bpf_prog still points at it. The next consumer of mana_xdp_get() - typically mana_chn_setxdp() from mana_alloc_queues() on the following ifup, or after a TX timeout reset - then calls bpf_prog_add() on freed memory. This is reachable from an ordinary "ip link set dev ethX xdp obj ..." whenever the per-queue RX buffer pre-allocation cannot be satisfied. Restore the previous program on that error path.
02KernelScan AI Analysis
Risk summary
A local user with network administration privileges can trigger a use-after-free in the MANA network driver by attaching an XDP program when memory is constrained. The dangling pointer to freed memory is dereferenced on the next interface up or reset, potentially leading to kernel code execution or a crash. This affects systems running the MANA driver, typically Microsoft Azure virtual machines on kernel 6.18 or later.
Vulnerability analysis
When an XDP program is attached to a MANA network interface, the driver stores the new program in its internal state before allocating the receive buffers that are sized based on that program. If the buffer pre-allocation fails — which happens under memory pressure — the error path returns without restoring the previously installed program. The attachment is reported as failed, so the BPF subsystem releases its reference and the program may be freed, yet the driver still holds a dangling pointer to it. The next operation that queries the XDP program — such as bringing the interface back up or recovering from a transmit timeout — then calls into the freed memory. The fix restores the previous program pointer on the allocation-failure path before returning, ensuring the driver never retains a reference to a program the BPF core has already released. This is reachable from a local process with network administration privileges that attaches an XDP program to a MANA interface; the MANA driver must be loaded, which is typical on Microsoft Azure virtual machines.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18 | 6.18.53 | 5b3cdc9abd82 |
| 7.2 | 6.18 | 7.2.7 | 9801edfba8df |
| mainline | 6.18 | 7.3-rc3 | 4c46beb807ef |