Summary
Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What do I have to do to protect myself from this vulnerability?
To help protect your systems from this vulnerability, update your Linux kernel to a version that includes the upstream fix for this issue. The fix has already been accepted upstream and will be included in newer kernel releases.
If your environment uses a Linux distribution that has not yet incorporated the updated kernel version, you should monitor your distribution vendor’s security advisories and apply the appropriate security update as soon as it becomes available. Some distributions may release the fix immediately through security updates, while others may include it in a future kernel package or maintenance release.
Organizations that maintain custom kernels or remain on older kernel branches may need to manually backport or apply the upstream patch according to their standard patch management and validation processes.
As a general best practice, ensure systems are regularly updated with the latest security patches and kernel releases provided by your operating system vendor.
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain ELEVATED privileges, which may allow them to perform actions beyond their original permissions.
According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
How could an attacker exploit the vulnerability?
An attacker who already has control of the host environment could trigger a flaw in the guest driver that mishandles memory. This could allow the attacker to read sensitive information from the guest and potentially use that access to gain higher privileges within the guest system.
Security updates
7.1 — https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=3985c9a56da4
Vulnerabilities 1
-
High 8.2
Microsoft Azure Network Adapter Elevation of Privilege Vulnerability
Use after free in Linux MANA Driver allows an authorized attacker to elevate privileges locally.
Revision history
-
#1
Information published.
References
-
CVE-2026-45476 Microsoft Azure Network Adapter Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45476
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss