In the Linux kernel, the following vulnerability has been resolved:
net: mana: Guard mana_remove against double invocation
If PM resume fails (e.g., mana_attach() returns an error), mana_probe()
calls mana_remove(), which tears down the device and sets
gd->gdma_context = NULL and gd->driver_data = NULL.
However, a failed resume callback does not automatically unbind the
driver. When the device is eventually unbound, mana_remove() is invoked
a second time. Without a NULL check, it dereferences gc->dev with
gc == NULL, causing a kernel panic.
Add an early return if gdma_context or driver_data is NULL so the second
invocation is harmless. Move the dev = gc->dev assignment after the
guard so it cannot dereference NULL.
References
Configurations
Configuration 1 (hide)
|
History
08 Jul 2026, 03:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/50271d7ec95144d26808025b508f463780517d3c - Patch | |
| References | () https://git.kernel.org/stable/c/a1ddfd2c0b7a48e5239fadd2a24cc4bc2cda90e6 - Patch | |
| References | () https://git.kernel.org/stable/c/bbe5c3c570645a4ceb120979d3ee203a1583d775 - Patch | |
| CWE | CWE-476 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
26 Jun 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-26 20:17
Updated : 2026-07-08 03:52
NVD link : CVE-2026-53297
Mitre link : CVE-2026-53297
CVE.ORG link : CVE-2026-53297
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-476
NULL Pointer Dereference