Use-After-Free Vulnerability in Linux Kernel Driver for Mana Network Interface

CVE-2026-43276

What is CVE-2026-43276?

A use-after-free vulnerability in the Linux kernel's mana network driver can lead to crashes during the service rescan PCI path. When the function 'mana_serv_reset()' interacts with 'mana_gd_suspend()', it inadvertently attempts to destroy a worker queue that has already been freed. This occurs if 'mana_gd_resume()' fails due to timeout or protocol issues, triggering a cascading call that attempts to clean up the already-released resource. The fix involves adding a null-check before destruction of the workqueue to prevent attempts to access freed memory, thereby enhancing the stability and security of the driver.

References