Linux Kernel EUVD-2026-32885

The vulnerability resides in the RDMA (Remote Direct Memory Access) driver for the Microsoft Azure Network Adapter (MANA) in the Linux kernel, first introduced at commit c15d7802a42402a87880a17eee89ff023e49ecc0 in Linux 6.8. The mana_ib_create_qp_rss() function creates Queue Pair objects with RSS (Receive Side Scaling) for hardware-distributed receive queuing. Its error unwind loop contains two defects: (1) a superfluous i-- inside the while loop body that conflicts with the loop's own decrement, causing the cleanup iterator to skip one WQ object, and (2) because of the resulting off-by-one index state, mana_destroy_wq_obj() is never called to undo mana_create_wq_obj() when mana_ib_install_cq_cb() returns an error. This constitutes an incomplete cleanup / improper resource release pattern (conceptually CWE-459 / CWE-415, though no CWE is formally assigned). The CPE cpe:2.3:o:linux:linux_kernel:* confirms the scope is the upstream Linux kernel across all architectures, but the code path is only reachable when the mana_ib module is loaded, which requires MANA NIC hardware exclusive to Azure. The 'Information Disclosure' tag present in source data conflicts with the CVSS C:N metric and the commit description - no confidentiality impact is indicated and this tag appears to be a tagging artifact.