CVE-2026-63972: net: mana: Skip redundant detach on already-detached port
In the Linux kernel, the following vulnerability has been resolved:
net: mana: Skip redundant detach on already-detached port
When manaperportqueueresetworkhandler() runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc->txqp and apc->rxqs already freed. Calling manadetach() again unconditionally leads to NULL pointer dereferences during queue teardown.
Add an early exit in manadetach() when the port is already in detached state (!netifdevicepresent) for non-close callers, making it safe to call idempotently. This allows the queue reset handler and other recovery paths to simply retry manaattach() without redundant teardown.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Modify Linux kernel net: mana so mana_detach() exits early when the port is already detached (!netif_device_present), preventing redundant teardown when apc->tx_qp and apc->rxqs have already been freed.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems using the MANA network driver. The failure path involves a port that was successfully detached and then failed to reattach during queue-reset or recovery processing.
What is required to trigger the crash condition?
The affected sequence requires a prior detach to succeed, a subsequent attach to fail, and then a queue reset handler or another recovery path to invoke mana_detach() again. The redundant teardown can dereference queue pointers that were already freed.
What is the operational impact?
The described result is NULL pointer dereferences during queue teardown, which can cause a denial of service. The provided severity vector indicates network reachability, low attack complexity, no privileges, and no user interaction.
How can administrators determine whether a system may be affected?
Review whether the running kernel includes one of the referenced stable fixes and whether the MANA driver is in use. Systems experiencing MANA port recovery or queue-reset failures after an unsuccessful reattach are the relevant condition described.