EUVD-2026-100608
GHSA-2w6f-cwvw-5j95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged account
-
DeliveryInvoke vulnerable MANA driver code path
-
ExploitWin TOCTOU race window
-
ExecutionCorrupt kernel state
-
ImpactEscalate to full kernel/root privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Exploitation Conditions | Exploitation requires a local, already-authenticated low-privilege account on the target (PR:L, AV:L) AND that the Microsoft MANA network driver be present and loaded - in practice limiting exposure to Azure-hosted or MANA-capable Linux systems rather than all Linux kernels. The attacker must also win a time-of-check/time-of-use race (CWE-367), reflected in AC:H, meaning exploitation is probabilistic and may need many attempts; there is no network vector and no user interaction. These limiters (local access, driver must be loaded, race must be won) make reliable exploitation meaningfully harder than the 7.0 score alone suggests. |
| Impact | This is a genuine but not emergency-grade privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0 High) describes a locally-exploitable flaw requiring an already-authenticated low-privilege user and a high-complexity race window, which materially dampens real-world risk despite the full C:H/I:H/A:H impact. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so exploitation likelihood cannot be quantified and there is no evidence of active exploitation - consistent with a TOCTOU race that is hard to win reliably rather than a mass-exploited remote bug. The AC:H rating directly reflects CWE-367 (TOCTOU), where the attacker must repeatedly lose/win a timing race, further lowering practical priority. One data caveat: the affected component per EUVD is specifically the Microsoft MANA network driver, so exposure is effectively limited to systems where that driver is loaded (chiefly Azure-hosted Linux), not all Linux kernels - this scoping is not reflected in the broad 'Linux' tag and should be verified against the MSRC advisory. A patch is reported available, which should be the primary mitigation driver. |
| Exploit ScenarioDerived | A low-privileged local user on an Azure-hosted Linux VM using the Microsoft MANA network driver repeatedly triggers a check/use sequence in the driver, racing to substitute state between the validation and the use to corrupt kernel memory and gain root-equivalent privileges. Because the flaw is a TOCTOU race (AC:H), success is probabilistic and may require many attempts. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in the Microsoft MANA network driver for the Linux kernel lets an authenticated low-privilege user on the host raise privileges to kernel/root level by winning a time-of-check time-of-use race in the driver (CWE-367). The attack is strictly local (AV:L) and high-complexity (AC:H) because the race must be won, and it only applies where the MANA driver is present and loaded - in practice Azure-hosted or MANA-capable Linux systems that use it as the primary network path. A vendor-released patch is available per the Microsoft advisory; no public exploit identified at time of analysis, and there is no confirmed active exploitation (not listed in CISA KEV).
RemediationAI
Apply the vendor-released patch documented in the Microsoft Security Response Center update guide for CVE-2026-62840 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62840) and, for third-party distribution builds, move to the kernel/MANA driver release designated by that distribution - EUVD records affected third-party distro versions below 7.3, so confirm the fixed build with your distribution vendor before considering the host remediated. Where patching must be deferred, note that the preconditions are demanding (local low-privilege account, MANA driver loaded, race must be won repeatedly), so the practical compensating controls are access- and exposure-reduction rather than feature disabling: restrict interactive shell and local multi-user access on MANA-capable hosts - especially Azure Linux VMs running untrusted or shared workloads - to trusted principals, since PR:L requires an already-authenticated local user; enforce MAC policy (SELinux or AppArmor) to limit what an escalated process can reach, accepting the trade-off that overly tight policy can break legitimate RDMA/MANA network workloads and must be tested first; and monitor for repeated driver-interface abuse (unusual ioctl, netlink, sysfs or RDMA verb calls) plus kernel oops/panic events, which are a likely side effect of failed race attempts under AC:H. Unloading or blacklisting the MANA driver is technically the direct workaround but is generally impractical on Azure VMs because MANA is the primary network path, so it should only be considered on non-Azure systems where the driver is present but unused, and it will disable networking or RDMA on that interface. There is no public exploit identified at time of analysis, but patch promptly because patch-available, local privilege-escalation issues are attractive post-compromise escalation primitives.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Microsoft's MANA (Microsoft Azure Network Adapter) driver, the paravirtualized NIC/RDMA stack presented to Linux guests on Azure, tracked by ENISA EUVD as 'Linux kernel - Microsoft MANA Network Driver'. The root cause is CWE-367, a time-of-check time-of-use race: the driver validates or resolves a resource or state (object reference, queue descriptor, device/file handle) and then uses it, while a concurrent local thread can mutate that state in the window between the check and the use. In kernel-driver context this class of bug typically manifests as use-after-free or stale-pointer/out-of-bounds access, which an attacker converts into memory corruption and ultimately privilege escalation. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the preconditions: the attacker must already hold a low-privilege local account (PR:L) able to reach the driver's interfaces, no user interaction is needed, the race requirement is reflected in AC:H, and a successful win yields full confidentiality, integrity and availability impact on the host (S:U). No network vector exists, and because the vulnerable code lives in a driver rather than core kernel logic, exposure is limited to systems where the MANA driver is loaded.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only kernel driver flaw (AV:L) exploitable by an authenticated low-priv user (PR:L); the TOCTOU timing race justifies AC:H, and successful EoP yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.
Articles & Coverage 1
Executive ViewAI
Microsoft's MANA network driver for the Linux kernel contains a high-severity local privilege escalation flaw that allows a local user to gain root-level access on affected systems, primarily Azure-hosted or MANA-capable Linux environments. While no public exploit or active exploitation has been identified, successful exploitation could compromise the confidentiality, integrity, and availability of cloud workloads and enable lateral movement. Leadership should prioritize patching because these systems often host critical business applications and the flaw undermines the security boundary between user and kernel.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB