Network Vulnerability Affecting Linux Kernel's Mana Driver

CVE-2026-63972

What is CVE-2026-63972?

A vulnerability has been identified in the Mana driver of the Linux kernel where redundant detach operations on already-detached ports can lead to NULL pointer dereferences. Specifically, if the mana_per_port_queue_reset_work_handler() function is executed after a detach has succeeded but an attach failed, the port remains in a detached state with freed transmit and receive queues. This can cause issues when mana_detach() is called again, potentially leading to instability during queue teardown. To mitigate this, an early exit has been implemented in mana_detach() for non-close callers, ensuring safe, idempotent calls without redundant teardown. This enhancement allows recovery paths to retry the attaching process smoothly.

References