Double Invocation Vulnerability in Linux Kernel Affecting Device Management

CVE-2026-53297

What is CVE-2026-53297?

A vulnerability in the Linux kernel related to the mana driver allows for a double invocation of the mana_remove function, which can cause kernel panic under certain conditions. If the device fails to resume and mana_attach() returns an error, the subsequent invocation of mana_remove() potentially dereferences a NULL pointer, resulting in system instability. The vulnerability has been addressed by ensuring that the function exits early if key context pointers are NULL, preventing such dereferencing and increasing the robustness of device management.

References