CVE-2026-43276: net: mana: Fix double destroy_workqueue on service rescan PCI path
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.251-5Fixed in 6.1.170-3Fixed in 6.1.172-1Fixed in 6.12.86-1Fixed in 6.12.90-1Fixed in 7.0.9-1 - Configuration
In mana_gd_cleanup(), NULL-check gc->service_wq before destroying it, and set gc->service_wq = NULL immediately after destruction to prevent double destroy on the service rescan PCI path.
Linux kernel net/mana (mana_gd_cleanup) gc->service_wq (workqueue pointer) = NULL-check before destroy and set to NULL after destruction
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43276?
CVE-2026-43276 has been categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2026-43276?
To fix CVE-2026-43276, update your Linux kernel to the latest version where this vulnerability has been patched.
What impact does CVE-2026-43276 have on systems?
CVE-2026-43276 can cause a use-after-free crash potentially leading to a denial of service.
Is CVE-2026-43276 exploitable remotely?
CVE-2026-43276 is not classified as remotely exploitable as it generally requires local access to exploit.
Which versions of the Linux kernel are affected by CVE-2026-43276?
CVE-2026-43276 affects specific versions of the Linux kernel prior to the patch release, so users should check their version for vulnerability.