CVE-2026-43276

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Fix double destroy_workqueue on service rescan PCI path

While testing corner cases in the driver, a use-after-free crash

was found on the service rescan PCI path.

When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup()

destroys gc->service_wq. If the subsequent mana_gd_resume() fails

with -ETIMEDOUT or -EPROTO, the code falls through to

mana_serv_rescan() which triggers pci_stop_and_remove_bus_device().

This invokes the PCI .remove callback (mana_gd_remove), which calls

mana_gd_cleanup() a second time, attempting to destroy the already-

freed workqueue. Fix this by NULL-checking gc->service_wq in

mana_gd_cleanup() and setting it to NULL after destruction.

Call stack of issue for reference:

[Sat Feb 21 18:53:48 2026] Call Trace:

[Sat Feb 21 18:53:48 2026] <TASK>

[Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana]

[Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana]

[Sat Feb 21 1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References