UBUNTU-CVE-2026-97955: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: net: mana: restore the XDP program pointer when pre-allocation fails manaxdpset() publishes the new program into apc->bpfprog before it allocates anything, because manapreallocrxbufs() sizes the buffers from it via managetrxbufcfg(). When that allocation fails the function returns the error directly, skipping the errdeallocrxbuffs label which is the only place that restores the previous pointer. The attach is reported as failed, so the BPF core drops the reference it held for the caller and the program can be freed, while apc->bpfprog still points at it. The next consumer of manaxdpget() - typically manachnsetxdp() from manaallocqueues() on the following ifup, or after a TX timeout reset - then calls bpfprogadd() on freed memory. This is reachable from an ordinary "ip link set dev ethX xdp obj ..." whenever the per-queue RX buffer pre-allocation cannot be satisfied. Restore the previous program on that error path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running one of the listed Ubuntu kernel packages are exposed when the Microsoft Azure Network Adapter (mana) driver is in use and XDP programs are attached to its network interface. The described trigger requires RX buffer pre-allocation to fail during XDP attachment.
What must an attacker or local user do to trigger the vulnerable path?
A user must attempt to attach an XDP program with a command such as "ip link set dev ethX xdp obj ..." while per-queue RX buffer pre-allocation cannot be satisfied. A later interface-up operation or TX-timeout reset can then consume the stale program pointer.
What is the impact after the failed XDP attachment?
The failed attachment can leave the driver holding a pointer to a BPF program that has been freed. A subsequent consumer can call bpf_prog_add() on that freed memory.
How can administrators identify whether the issue may have been triggered already?
Review whether an XDP attachment to a mana interface failed during RX buffer pre-allocation, then determine whether the interface was subsequently brought up or experienced a TX-timeout reset. Those follow-on events are identified as typical paths that consume the stale pointer.