CVE-2026-23454

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown

A potential race condition exists in mana_hwc_destroy_channel() where

hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and

Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt

handler to dereference freed memory, leading to a use-after-free or

NULL pointer dereference in mana_hwc_handle_resp().

mana_smc_teardown_hwc() signals the hardware to stop but does not

synchronize against IRQ handlers already executing on other CPUs. The

IRQ synchronization only happens in mana_hwc_destroy_cq() via

mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs

after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler()

can dereference freed caller_ctx (and rxq->msg_buf) in

mana_hwc_handle_resp().

Fix this by reordering teardown to reverse-of-creation order: destroy

the TX/RX work queues and CQ/EQ b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References