CVE-2026-23454: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade debian/linux to a version that resolves this vulnerability.

   Fixed in 6.1.170-1
2. Upgrade

   Upgrade debian/linux to a version that resolves this vulnerability.

   Fixed in 6.12.85-1
3. Upgrade

   Upgrade debian/linux to a version that resolves this vulnerability.

   Fixed in 6.19.10-1
4. Upgrade

   Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

   Fixed in 5.15.0-1112.119~20.04.1
5. Upgrade

   Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

   Fixed in 5.15.0-1117.126~20.04.1
6. Upgrade

   Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.

   Fixed in 5.15.0-1117.126~20.04.2
7. Upgrade

   Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

   Fixed in 5.15.0-1112.122~20.04.1
8. Upgrade

   Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

   Fixed in 5.15.0-186.196~20.04.1
9. Upgrade

   Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.

   Fixed in 5.15.0-1106.110~20.04.1
10. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1107.113~20.04.1
11. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-184.194~20.04.1
12. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1064.66~20.04.1
13. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.115~20.04.1
14. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.110~20.04.1
15. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-186.196
16. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.119
17. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.64~22.04.1
18. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126
19. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.71~22.04.1
20. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126
21. Upgrade

    Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.69~22.04.1
22. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.122
23. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.72~22.04.1
24. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1108.114
25. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1095.103
26. Upgrade

    Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136~22.04.1
27. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.110
28. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.62~22.04.1
29. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1107.113
30. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1104.109
31. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-184.194
32. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136.2~22.04.1
33. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1107.108
34. Upgrade

    Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.62~22.04.1
35. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1064.66
36. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.

    Fixed in 5.15.0-1053.53
37. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.115
38. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.61~22.04.1
39. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.109
40. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136~22.04.3
41. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1075.79
42. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1096.98
43. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1104.106
44. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1111.120
45. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1056.57~22.04.2
46. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.119+fips1
47. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126+fips1
48. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-186.196+fips1
49. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.122+fips1
50. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136
51. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.64
52. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.71
53. Upgrade

    Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1015.15~24.04.1
54. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.69
55. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.72
56. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.67
57. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1046.50
58. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.62
59. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136.2
60. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.62
61. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.62.1
62. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1030.31
63. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.61
64. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.65
65. Upgrade

    Upgrade ubuntu/linux-vmware to a version that resolves this vulnerability.

    Fixed in 6.8.0-1008.8
66. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1033.34
67. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.33
68. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2050.52
69. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1056.57
70. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.64+fips1
71. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.71+fips2
72. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136+fips2
73. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.72+fips1
74. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.17.0-1015.15
75. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 5.15.203
76. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.1.167
77. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.6.130
78. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.12.78
79. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.18.20
80. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.19.10
81. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1
82. Configuration

    Reorder mana_hwc_destroy_channel() teardown so the TX/RX work queues and CQ/EQ are destroyed/deregistered before freeing hwc->caller_ctx; ensure teardown runs in reverse-of-creation order to prevent UAF/NULL dereference.

    Linux kernel (net: mana) mana_hwc_destroy_channel teardown order = destroy TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx
83. Configuration

    Ensure mana_smc_teardown_hwc() (which stops hardware) also synchronizes against IRQ handlers already executing on other CPUs, so in-flight CQ/EQ interrupt handlers complete before the memory (e.g., hwc->caller_ctx and rxq->msg_buf) is freed.

    Linux kernel (net: mana) IRQ synchronization during HWC teardown = synchronize against IRQ handlers already executing on other CPUs

Event History

Parent advisories

This vulnerability appears in the following advisories.

• DSA-6238
• DSA-6243

Peer vulnerabilities

Found alongside the following vulnerabilities.

• DLA-4561-1

Frequently Asked Questions