CVE-2026-43276: net: mana: Fix double destroy_workqueue on service rescan PCI path
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.6-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.16 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
ubuntu/linux-azure-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.17.0-1015.15 - Configuration
In mana_gd_cleanup(), NULL-check gc->service_wq before destroying it, and set gc->service_wq = NULL immediately after destruction to prevent double destroy on the service rescan PCI path.
Linux kernel net/mana (mana_gd_cleanup) gc->service_wq (workqueue pointer) = NULL-check before destroy and set to NULL after destruction
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43276?
CVE-2026-43276 has been categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2026-43276?
To fix CVE-2026-43276, update your Linux kernel to the latest version where this vulnerability has been patched.
What impact does CVE-2026-43276 have on systems?
CVE-2026-43276 can cause a use-after-free crash potentially leading to a denial of service.
Is CVE-2026-43276 exploitable remotely?
CVE-2026-43276 is not classified as remotely exploitable as it generally requires local access to exploit.
Which versions of the Linux kernel are affected by CVE-2026-43276?
CVE-2026-43276 affects specific versions of the Linux kernel prior to the patch release, so users should check their version for vulnerability.