CVE-2025-21953

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mana: cleanup mana struct after debugfs_remove()

When on a MANA VM hibernation is triggered, as part of hibernate_snapshot(),

mana_gd_suspend() and mana_gd_resume() are called. If during this

mana_gd_resume(), a failure occurs with HWC creation, mana_port_debugfs

pointer does not get reinitialized and ends up pointing to older,

cleaned-up dentry.

Further in the hibernation path, as part of power_down(), mana_gd_shutdown()

is triggered. This call, unaware of the failures in resume, tries to cleanup

the already cleaned up mana_port_debugfs value and hits the following bug:

[ 191.359296] mana 7870:00:00.0: Shutdown was called

[ 191.359918] BUG: kernel NULL pointer dereference, address: 0000000000000098

[ 191.360584] #PF: supervisor write access in kernel mode

[ 191.361125] #PF: error_code(0x0002) - not-present page

[ 191.361727] PGD 1080ea067 P4D 0

[ 191.362172] Oops: Oops: 0002 [#1] SMP NOPTI

[ 191.362606

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References