CVE-2026-97955: net: mana: restore the XDP program pointer when pre-allocation fails
In the Linux kernel, the following vulnerability has been resolved:
net: mana: restore the XDP program pointer when pre-allocation fails
manaxdpset() publishes the new program into apc->bpfprog before it allocates anything, because manapreallocrxbufs() sizes the buffers from it via managetrxbufcfg(). When that allocation fails the function returns the error directly, skipping the errdeallocrxbuffs label which is the only place that restores the previous pointer.
The attach is reported as failed, so the BPF core drops the reference it held for the caller and the program can be freed, while apc->bpfprog still points at it. The next consumer of manaxdpget() - typically manachnsetxdp() from manaallocqueues() on the following ifup, or after a TX timeout reset - then calls bpfprogadd() on freed memory.
This is reachable from an ordinary "ip link set dev ethX xdp obj ..." whenever the per-queue RX buffer pre-allocation cannot be satisfied.
Restore the previous program on that error path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restore the previous XDP program pointer in mana_xdp_set() when per-queue RX buffer pre-allocation fails, before returning the allocation error.
Event History
Frequently Asked Questions
What conditions are required to trigger the stale XDP program pointer?
An attempt to attach an XDP program through an ordinary "ip link set dev ethX xdp obj ..." operation must reach the mana driver, and per-queue RX buffer pre-allocation must fail. The failed attach leaves the driver pointer referring to a program whose reference may then be released by the BPF core.
When is the freed pointer likely to be used after a failed attachment?
A later consumer of mana_xdp_get() can use it, typically when queues are allocated during the next interface-up operation or following a TX-timeout reset. That path can call bpf_prog_add() on freed memory.
How can I determine whether a system encountered the vulnerable state?
Look for a failed XDP attachment on a mana interface where RX buffer pre-allocation could not be satisfied, followed by an interface-down/interface-up cycle or a TX timeout reset. The provided information does not identify a specific log message or other direct detection indicator.