In the Linux kernel, the following vulnerability has been resolved:
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
A potential race condition exists in mana_hwc_destroy_channel() where
hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and
Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt
handler to dereference freed memory, leading to a use-after-free or
NULL pointer dereference in mana_hwc_handle_resp().
mana_smc_teardown_hwc() signals the hardware to stop but does not
synchronize against IRQ handlers already executing on other CPUs. The
IRQ synchronization only happens in mana_hwc_destroy_cq() via
mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs
after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler()
can dereference freed caller_ctx (and rxq->msg_buf) in
mana_hwc_handle_resp().
Fix this by reordering teardown to reverse-of-creation order: destroy
the TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx. This
ensures all in-flight interrupt handlers complete before the memory they
access is freed.
References
Configurations
Configuration 1 (hide)
|
History
26 May 2026, 14:48
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.0 |
| First Time |
Linux
Linux linux Kernel |
|
| References | () https://git.kernel.org/stable/c/05d345719d85b927cba74afac4d5322de3aa4256 - Patch | |
| References | () https://git.kernel.org/stable/c/249e905571583a434d4ea8d6f92ccc0eef337115 - Patch | |
| References | () https://git.kernel.org/stable/c/2b001901f689021acd7bf2dceed74a1bdcaaa1f9 - Patch | |
| References | () https://git.kernel.org/stable/c/afdb1533eb9c05432aeb793a7280fa827c502f5c - Patch | |
| References | () https://git.kernel.org/stable/c/b88edf12fc3779521ae5f6f1584153b15f7da6df - Patch | |
| References | () https://git.kernel.org/stable/c/e23bf444512cb85d76012080a76cd1f9e967448e - Patch | |
| References | () https://git.kernel.org/stable/c/fa103fc8f56954a60699a29215cb713448a39e87 - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
|
| CWE | CWE-416 |
18 Apr 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-03 16:16
Updated : 2026-05-26 14:48
NVD link : CVE-2026-23454
Mitre link : CVE-2026-23454
CVE.ORG link : CVE-2026-23454
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free