Use-after-free Vulnerability in Linux Kernel Affects Mana Auxiliary Device

CVE-2026-43056

What is CVE-2026-43056?

A vulnerability has been identified in the Linux kernel that affects the Mana auxiliary device. This issue arises from a use-after-free condition encountered during the error handling of the auxiliary device initialization process. If the auxiliary_device_add() function fails, control shifts to an error-handling path. At this stage, the callback for the auxiliary device is invoked, which deallocates the corresponding mana_adev structure. Consequently, when the program attempts to access the adev->id, it may interact with freed memory, leading to potential exploitation risks. A resolution has been implemented by saving the auxiliary device ID in a local variable prior to the addition process, ensuring that the correct and valid ID is utilized and preventing access to released resources.

References