Linux Kernel Mana Driver Use-After-Free via HWC Teardown Race
CVE-2026-23454 Published on April 3, 2026
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
In the Linux kernel, the following vulnerability has been resolved:
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
A potential race condition exists in mana_hwc_destroy_channel() where
hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and
Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt
handler to dereference freed memory, leading to a use-after-free or
NULL pointer dereference in mana_hwc_handle_resp().
mana_smc_teardown_hwc() signals the hardware to stop but does not
synchronize against IRQ handlers already executing on other CPUs. The
IRQ synchronization only happens in mana_hwc_destroy_cq() via
mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs
after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler()
can dereference freed caller_ctx (and rxq->msg_buf) in
mana_hwc_handle_resp().
Fix this by reordering teardown to reverse-of-creation order: destroy
the TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx. This
ensures all in-flight interrupt handlers complete before the memory they
access is freed.
Products Associated with CVE-2026-23454
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f and below e23bf444512cb85d76012080a76cd1f9e967448e is affected.
- Version ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f and below 249e905571583a434d4ea8d6f92ccc0eef337115 is affected.
- Version ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f and below 2b001901f689021acd7bf2dceed74a1bdcaaa1f9 is affected.
- Version ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f and below afdb1533eb9c05432aeb793a7280fa827c502f5c is affected.
- Version ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f and below 05d345719d85b927cba74afac4d5322de3aa4256 is affected.
- Version ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f and below fa103fc8f56954a60699a29215cb713448a39e87 is affected.
- Version 5.13 is affected.
- Before 5.13 is unaffected.
- Version 6.1.167, <= 6.1.* is unaffected.
- Version 6.6.130, <= 6.6.* is unaffected.
- Version 6.12.78, <= 6.12.* is unaffected.
- Version 6.18.20, <= 6.18.* is unaffected.
- Version 6.19.10, <= 6.19.* is unaffected.
- Version 7.0-rc5, <= * is unaffected.