CVE-2026-23454: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.251-5Fixed in 6.1.170-3Fixed in 6.1.172-1Fixed in 6.12.86-1Fixed in 6.12.90-1Fixed in 7.0.9-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.172-1~deb11u1 - Configuration
Reorder mana_hwc_destroy_channel() teardown so the TX/RX work queues and CQ/EQ are destroyed/deregistered before freeing hwc->caller_ctx; ensure teardown runs in reverse-of-creation order to prevent UAF/NULL dereference.
Linux kernel (net: mana) mana_hwc_destroy_channel teardown order = destroy TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx - Configuration
Ensure mana_smc_teardown_hwc() (which stops hardware) also synchronizes against IRQ handlers already executing on other CPUs, so in-flight CQ/EQ interrupt handlers complete before the memory (e.g., hwc->caller_ctx and rxq->msg_buf) is freed.
Linux kernel (net: mana) IRQ synchronization during HWC teardown = synchronize against IRQ handlers already executing on other CPUs
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23454?
The severity of CVE-2026-23454 is rated as high with a score of 7 according to the CVSS 3.1 metrics.
What does CVE-2026-23454 affect?
CVE-2026-23454 affects the Linux kernel, specifically the mana_hwc_destroy_channel() function.
How do I fix CVE-2026-23454?
To fix CVE-2026-23454, ensure that your Linux kernel is updated to the latest version that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-23454?
CVE-2026-23454 is categorized as a use-after-free vulnerability that can lead to a race condition.
When was CVE-2026-23454 published?
CVE-2026-23454 was published on April 3, 2026.