What is the CVSS score of CVE-2026-63972?

CVE-2026-63972 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63972?

The Linux kernel MANA Ethernet driver for Microsoft Azure contains a denial-of-service vulnerability that could crash systems and interrupt service availability for Azure-hosted Linux workloads.. A patch is available.

How to fix or mitigate CVE-2026-63972?

Within 24 hours, identify all Linux systems in your Azure environment running the MANA Ethernet driver and assess their criticality to business operations. Within 7 days, obtain the vendor-released patch from Microsoft or your Linux distribution provider and validate it in a non-production Azure test environment. Within 30 days, deploy the patch to all affected production systems using your standard change management process, staging rollouts by system criticality to minimize operational risk.

Linux Kernel CVE-2026-63972

EUVD-2026-45745 HIGH

2026-07-19 Linux

GHSA-h62q-3pmg-9366

Denial Of Service Linux

7.5

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.7 MEDIUM

Crash arises from an internal MANA attach-failure recovery state, not remote packets, so AV:L and AC:H; some local privilege/device control is needed (PR:L) and impact is availability-only.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:35 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.5 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 7.5

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Skip redundant detach on already-detached port

When mana_per_port_queue_reset_work_handler() runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc->tx_qp and apc->rxqs already freed. Calling mana_detach() again unconditionally leads to NULL pointer dereferences during queue teardown.

Add an early exit in mana_detach() when the port is already in detached state (!netif_device_present) for non-close callers, making it safe to call idempotently. This allows the queue reset handler and other recovery paths to simply retry mana_attach() without redundant teardown.

AnalysisAI

Denial of service in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver allows the port reset recovery path to trigger a NULL pointer dereference and kernel crash. The flaw occurs when mana_per_port_queue_reset_work_handler() runs after a prior detach succeeded but a subsequent attach failed, leaving apc->tx_qp and apc->rxqs freed; a second unconditional mana_detach() then dereferences NULL during queue teardown. No public exploit has been identified, EPSS is low (0.20%, 10th percentile), and the CVSS 3.1 score is 7.5 driven purely by availability impact.

Technical ContextAI

The affected component is the MANA driver (drivers/net/ethernet/microsoft/mana) which provides networking for Linux guests running on Microsoft Azure using the Azure Network Adapter virtual hardware. The root cause is a NULL pointer dereference (CWE-476, though the feed lists CWE as N/A) in the port recovery state machine: after a detach frees the transmit queue pairs (tx_qp) and receive queues (rxqs), a failed re-attach leaves the port in a detached state (!netif_device_present), and calling mana_detach() again walks structures that have already been freed. The fix adds an idempotency guard - an early exit in mana_detach() when the port is already detached for non-close callers - so recovery paths such as the queue reset handler can safely retry mana_attach() without redundant teardown. The CPE data (cpe:2.3:a:linux:linux) is generic to the kernel and does not narrow to the driver, but the code path is exclusive to Azure MANA-backed interfaces.

RemediationAI

Vendor-released patch: upgrade to Linux 6.18.35 or later (or the corresponding fixed 7.0.x/7.1 build for those trees), which adds the idempotency guard in mana_detach(). Apply the stable fix commits from https://git.kernel.org/stable/c/c4152b4e28b3e550ec99351bf900e2c24c2608cc (and companions 7ae590797f9b5c240aaea5773f5f00977a42a846 and 5b05aa36ee24297d7296ca58dfd8c448d0e4cda3) if backporting to a custom kernel. For Azure guest fleets, follow your distribution's kernel update channel (the fix will flow into Azure-tuned kernel images). No practical pre-patch workaround exists because the crash originates in the driver's internal recovery path rather than a toggleable feature; the only compensating control is operational - monitor for and reduce MANA interface attach failures (e.g. avoid churn that induces port detach/re-attach cycles) and ensure host/VM live-migration and NIC hotplug events are stable, accepting that this only reduces, not eliminates, the trigger condition.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63972 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63972

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code