CVE-2026-45476: Microsoft Azure Network Adapter Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability in the Microsoft MANA (Azure Network Adapter) Linux kernel driver allows a locally authenticated attacker with administrative privileges to escalate their privileges further on the affected host. The vulnerability is reached locally, requires no network exposure, and demands a high-privilege account to trigger. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the system, including the ability to break out of the current security scope into affected components. A patched-image rebuild at version 7.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the vulnerable component is required.

• AuthenticationRequired

  An admin or otherwise privileged account is required to trigger the use-after-free condition in the MANA driver.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the vulnerability entirely through their own actions.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Reads sensitive kernel memory and any confidential data accessible from the elevated security scope, including credentials and keys held in memory.
• Modifies kernel data structures and persisted state within the scope change boundary, enabling tamper with system integrity.
• Crashes or destabilizes the affected kernel component, causing service disruption to the host and any workloads depending on the MANA network adapter.
• The scope change (S:C) means impact extends beyond the originating process into other components sharing the host, amplifying all three impact dimensions.