Linux Kernel CVE-2026-53297

Exploitation requires all of the following: (1) the target system must be a Linux VM running on Microsoft Azure using the MANA virtual NIC driver (not present on physical hardware or non-Azure hypervisors); (2) a power management resume failure must occur - specifically, mana_attach() must return an error during PM resume - which sets gdma_context to NULL via the mana_probe() error path; (3) after this failure, the MANA driver must be unbound (e.g., via driver reload, device hotplug removal, or VM lifecycle operations) to trigger the second mana_remove() invocation; (4) local access with at least low-privilege credentials (PR:L per CVSS) is required to be present on the system, though the PM failure itself may be environmental rather than attacker-triggered. Limiting factors: the vulnerability is not remotely triggerable (AV:L), requires the MANA driver to be loaded and in a post-PM-failure torn-down state, and produces only a denial-of-service (kernel panic) with no data exfiltration or privilege escalation.

Real-world risk is moderate-to-low despite a CVSS availability impact of High. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H correctly identifies this as a local, low-privilege issue with no confidentiality or integrity impact - a kernel panic/reboot is the worst outcome. The EPSS score of 0.17% (6th percentile) aligns with the low exploitability: the attack requires a specific, non-default precondition (a PM resume failure that partially tears down the MANA driver), meaning an attacker cannot reliably trigger it on demand without engineering that failure state. No KEV listing and no public exploit code further reduce urgency. The assigned CVSS AC:L slightly overstates the ease of exploitation since the PM resume failure is not attacker-controlled in the general case; an independent assessment would place AC:H. The vulnerability is scoped to Azure Linux VMs using the MANA virtual NIC - physical servers, non-Azure cloud VMs, and Azure VMs not using MANA are unaffected. In summary, this is a real but low-probability, environment-specific DoS that warrants routine patching rather than emergency response.

A local user on an Azure Linux VM with the MANA virtual NIC encounters (or induces) a PM resume failure - for example, by triggering a suspend/resume cycle during a transient network configuration error that causes mana_attach() to return an error. The kernel's mana_probe() error path then calls mana_remove(), nullifying gdma_context. When the MANA device is subsequently unbound (e.g., during driver reload or VM migration preparation), the second mana_remove() invocation dereferences the NULL gc pointer at gc->dev, producing an unrecoverable kernel panic and forcing a VM reboot. No public exploit code exists for this scenario.