CVE-2026-72065RCE potencial en el kernel Linux (driver MANA)
In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted.
Ver en NVDAnálisis
A critical vulnerability has been identified in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver. The driver fails to validate packet lengths reported by the hardware, which can lead to memory corruption. This is a significant risk for any Linux-based workloads running on Azure infrastructure.
Roles relevantes
Severidad
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HEPSS
Descripción técnica
In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted.
Referencias
- https://git.kernel.org/stable/c/282c5214ca4eb3799158c76782646e86d2945d1b
- https://git.kernel.org/stable/c/2e276b14b6d378372bf0152df89286cbe7632fb0
- https://git.kernel.org/stable/c/2e2a83b4998af4384e677d3b2ac08565274279bf
- https://git.kernel.org/stable/c/6080189291d958604dcefe513a13900835ac982f
- https://git.kernel.org/stable/c/6d13eaa13341a8f80aaf86f78591e1b1d393711d
- https://git.kernel.org/stable/c/a631f82f89c76084ad5b2b9c043d3b391ffa56d8
- https://git.kernel.org/stable/c/d2568e64d01f480200063fadd67d6938f676c66f