|
Vulnerabilities
< Back

CVE-2026-43276

Updated on 06 May 2026

Severity

7.8 High severity

Details

CVSS score
7.8
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Fix double destroy_workqueue on service rescan PCI path

While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path.

When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() destroys gc->service_wq. If the subsequent mana_gd_resume() fails with -ETIMEDOUT or -EPROTO, the code falls through to mana_serv_rescan() which triggers pci_stop_and_remove_bus_device(). This invokes the PCI .remove callback (mana_gd_remove), which calls mana_gd_cleanup() a second time, attempting to destroy the already- freed workqueue. Fix this by NULL-checking gc->service_wq in mana_gd_cleanup() and setting it to NULL after destruction.

Call stack of issue for reference: [Sat Feb 21 18:53:48 2026] Call Trace: [Sat Feb 21 18:53:48 2026] [Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana] [Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana] [Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0 [Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70 [Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250 [Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20 [Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90 [Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30 [Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana] [Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana] [Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0 [Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0 [Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130 [Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350 [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30 [Sat Feb 21 18:53:48 2026]

Details

Affected product:
AlmaLinux 9.2 ESU , TuxCare 9.6 ESU
Affected packages:
kernel @ 5.14.0 (+1 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
AlmaLinux 10 In Rollout
34 kernels
  • 6.12.0-124.8.1.el10_1
  • 6.12.0-124.13.1.el10_1
  • 6.12.0-124.16.1.el10_1
  • 6.12.0-124.20.1.el10_1
  • 6.12.0-124.21.1.el10_1
  • 6.12.0-124.27.1.el10_1
  • 6.12.0-124.28.1.el10_1
  • 6.12.0-124.29.1.el10_1
  • 6.12.0-124.31.1.el10_1
  • 6.12.0-124.35.1.el10_1
  • 6.12.0-124.38.1.el10_1
  • 6.12.0-124.39.1.el10_1
  • 6.12.0-124.43.1.el10_1
  • 6.12.0-124.45.1.el10_1
  • 6.12.0-124.47.1.el10_1
  • 6.12.0-124.49.1.el10_1
  • 6.12.0-124.52.1.el10_1
  • 6.12.0-124.55.1.el10_1
  • 6.12.0-124.40.1.el10_1
  • 6.12.0-124.52.2.el10_1
  • 6.12.0-124.52.3.el10_1
  • 6.12.0-211.7.1.el10_2
  • 6.12.0-211.7.3.el10_2
  • 6.12.0-124.56.5.el10_1
  • 6.12.0-124.55.3.el10_1
  • 6.12.0-211.20.1.el10_2
  • 6.12.0-211.18.1.el10_2
  • 6.12.0-211.16.1.el10_2
  • 6.12.0-211.22.1.el10_2
  • 6.12.0-211.26.1.el10_2
  • 6.12.0-211.28.1.el10_2
  • 6.12.0-211.29.1.el10_2
  • 6.12.0-211.30.1.el10_2
  • 6.12.0-211.7.4.el10_2
AlmaLinux 9 In Rollout
34 kernels
  • 5.14.0-611.5.1.el9_7
  • 5.14.0-611.9.1.el9_7
  • 5.14.0-611.11.1.el9_7
  • 5.14.0-611.13.1.el9_7
  • 5.14.0-611.16.1.el9_7
  • 5.14.0-611.20.1.el9_7
  • 5.14.0-611.24.1.el9_7
  • 5.14.0-611.26.1.el9_7
  • 5.14.0-611.27.1.el9_7
  • 5.14.0-611.30.1.el9_7
  • 5.14.0-611.34.1.el9_7
  • 5.14.0-611.35.1.el9_7
  • 5.14.0-611.36.1.el9_7
  • 5.14.0-611.38.1.el9_7
  • 5.14.0-611.41.1.el9_7
  • 5.14.0-611.45.1.el9_7
  • 5.14.0-611.42.1.el9_7
  • 5.14.0-611.47.1.el9_7
  • 5.14.0-611.49.1.el9_7
  • 5.14.0-611.54.1.el9_7
  • 5.14.0-611.49.2.el9_7
  • 5.14.0-611.54.3.el9_7
  • 5.14.0-611.54.6.el9_7
  • 5.14.0-687.5.1.el9_8
  • 5.14.0-687.5.3.el9_8
  • 5.14.0-611.55.1.el9_7
  • 5.14.0-687.10.1.el9_8
  • 5.14.0-687.12.1.el9_8
  • 5.14.0-687.13.1.el9_8
  • 5.14.0-687.15.1.el9_8
  • 5.14.0-687.5.4.el9_8
  • 5.14.0-687.17.1.el9_8
  • 5.14.0-687.19.1.el9_8
  • 5.14.0-687.20.1.el9_8
Oracle Linux 9 Released
27 kernels
  • 5.14.0-611.5.1.el9_7
  • 5.14.0-611.9.1.el9_7
  • 5.14.0-611.7.1.el9_7
  • 5.14.0-611.8.1.el9_7
  • 5.14.0-611.11.1.el9_7
  • 5.14.0-611.13.1.el9_7
  • 5.14.0-611.16.1.el9_7
  • 5.14.0-611.20.1.el9_7
  • 5.14.0-611.24.1.el9_7
  • 5.14.0-611.26.1.el9_7
  • 5.14.0-611.27.1.el9_7
  • 5.14.0-611.30.1.el9_7
  • 5.14.0-611.34.1.el9_7
  • 5.14.0-611.35.1.el9_7
  • 5.14.0-611.36.1.el9_7
  • 5.14.0-611.38.1.el9_7
  • 5.14.0-611.41.1.el9_7
  • 5.14.0-611.42.1.el9_7
  • 5.14.0-611.45.1.el9_7
  • 5.14.0-611.47.1.el9_7
  • 5.14.0-611.49.1.el9_7
  • 5.14.0-611.54.1.el9_7
  • 5.14.0-611.55.1.el9_7
  • 5.14.0-687.5.3.el9_8
  • 5.14.0-687.17.1.el9_8
  • 5.14.0-687.20.1.el9_8
  • 5.14.0-687.19.1.el9_8
RHEL 10 In Rollout
32 kernels
  • 6.12.0-124.9.1.el10_1
  • 6.12.0-124.8.1.el10_1
  • 6.12.0-124.11.1.el10_1
  • 6.12.0-124.13.1.el10_1
  • 6.12.0-124.16.1.el10_1
  • 6.12.0-124.20.1.el10_1
  • 6.12.0-124.21.1.el10_1
  • 6.12.0-124.27.1.el10_1
  • 6.12.0-124.28.1.el10_1
  • 6.12.0-124.29.1.el10_1
  • 6.12.0-124.31.1.el10_1
  • 6.12.0-124.35.1.el10_1
  • 6.12.0-124.38.1.el10_1
  • 6.12.0-124.39.1.el10_1
  • 6.12.0-124.43.1.el10_1
  • 6.12.0-124.45.1.el10_1
  • 6.12.0-124.47.1.el10_1
  • 6.12.0-124.49.1.el10_1
  • 6.12.0-124.52.1.el10_1
  • 6.12.0-124.55.1.el10_1
  • 6.12.0-124.56.1.el10_1
  • 6.12.0-211.16.1.el10_2
  • 6.12.0-211.7.1.el10_2
  • 6.12.0-211.7.3.el10_2
  • 6.12.0-124.40.1.el10_1
  • 6.12.0-211.18.1.el10_2
  • 6.12.0-211.20.1.el10_2
  • 6.12.0-211.22.1.el10_2
  • 6.12.0-211.26.1.el10_2
  • 6.12.0-211.28.1.el10_2
  • 6.12.0-211.29.1.el10_2
  • 6.12.0-211.30.1.el10_2
RHEL 9 Released
32 kernels
  • 5.14.0-611.5.1.el9_7
  • 5.14.0-611.7.1.el9_7
  • 5.14.0-611.8.1.el9_7
  • 5.14.0-611.9.1.el9_7
  • 5.14.0-611.11.1.el9_7
  • 5.14.0-611.13.1.el9_7
  • 5.14.0-611.16.1.el9_7
  • 5.14.0-611.20.1.el9_7
  • 5.14.0-611.24.1.el9_7
  • 5.14.0-611.26.1.el9_7
  • 5.14.0-611.27.1.el9_7
  • 5.14.0-611.30.1.el9_7
  • 5.14.0-611.34.1.el9_7
  • 5.14.0-611.35.1.el9_7
  • 5.14.0-611.36.1.el9_7
  • 5.14.0-611.38.1.el9_7
  • 5.14.0-611.41.1.el9_7
  • 5.14.0-611.42.1.el9_7
  • 5.14.0-611.45.1.el9_7
  • 5.14.0-611.47.1.el9_7
  • 5.14.0-611.49.1.el9_7
  • 5.14.0-611.54.1.el9_7
  • 5.14.0-611.55.1.el9_7
  • 5.14.0-687.5.1.el9_8
  • 5.14.0-687.5.3.el9_8
  • 5.14.0-687.10.1.el9_8
  • 5.14.0-687.12.1.el9_8
  • 5.14.0-687.13.1.el9_8
  • 5.14.0-687.15.1.el9_8
  • 5.14.0-687.17.1.el9_8
  • 5.14.0-687.19.1.el9_8
  • 5.14.0-687.20.1.el9_8
Rocky Linux 10 In Rollout
23 kernels
  • 6.12.0-124.8.1.el10_1
  • 6.12.0-124.13.1.el10_1
  • 6.12.0-124.16.1.el10_1
  • 6.12.0-124.20.1.el10_1
  • 6.12.0-124.21.1.el10_1
  • 6.12.0-124.27.1.el10_1
  • 6.12.0-124.28.1.el10_1
  • 6.12.0-124.29.1.el10_1
  • 6.12.0-124.31.1.el10_1
  • 6.12.0-124.35.1.el10_1
  • 6.12.0-124.38.1.el10_1
  • 6.12.0-124.45.1.el10_1
  • 6.12.0-124.47.1.el10_1
  • 6.12.0-124.49.1.el10_1
  • 6.12.0-124.52.1.el10_1
  • 6.12.0-124.55.1.el10_1
  • 6.12.0-124.56.1.el10_1
  • 6.12.0-124.40.1.el10_1
  • 6.12.0-211.18.1.el10_2
  • 6.12.0-211.22.1.el10_2
  • 6.12.0-211.26.1.el10_2
  • 6.12.0-211.28.1.el10_2
  • 6.12.0-211.16.1.el10_2.0.1
Rocky Linux 9 In Rollout
22 kernels
  • 5.14.0-611.5.1.el9_7
  • 5.14.0-611.9.1.el9_7
  • 5.14.0-611.11.1.el9_7
  • 5.14.0-611.13.1.el9_7
  • 5.14.0-611.16.1.el9_7
  • 5.14.0-611.20.1.el9_7
  • 5.14.0-611.24.1.el9_7
  • 5.14.0-611.27.1.el9_7
  • 5.14.0-611.26.1.el9_7
  • 5.14.0-611.30.1.el9_7
  • 5.14.0-611.34.1.el9_7
  • 5.14.0-611.36.1.el9_7
  • 5.14.0-611.41.1.el9_7
  • 5.14.0-611.45.1.el9_7
  • 5.14.0-611.47.1.el9_7
  • 5.14.0-611.49.1.el9_7
  • 5.14.0-611.54.1.el9_7
  • 5.14.0-611.55.1.el9_7
  • 5.14.0-687.12.1.el9_8
  • 5.14.0-687.15.1.el9_8
  • 5.14.0-687.17.1.el9_8
  • 5.14.0-687.10.1.el9_8.0.1