CVE-2026-63973

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Add NULL guards in teardown path to prevent panic on attach failure

When queue allocation fails partway through, the error cleanup frees

and NULLs apc->tx_qp and apc->rxqs. Multiple teardown paths such as

mana_remove(), mana_change_mtu() recovery, and internal error handling

in mana_alloc_queues() can subsequently call into functions that

dereference these pointers without NULL checks:

- mana_chn_setxdp() dereferences apc->rxqs[0], causing a NULL pointer

dereference panic (CR2: 0000000000000000 at mana_chn_setxdp+0x26).

- mana_destroy_vport() iterates apc->rxqs without a NULL check.

- mana_fence_rqs() iterates apc->rxqs without a NULL check.

- mana_dealloc_queues() iterates apc->tx_qp without a NULL check.

Add NULL guards for apc->rxqs in mana_fence_rqs(),

mana_destroy_vport(), and before the mana_chn_setxdp() call. Add a

NULL guard for apc->tx_qp in mana_dealloc_queues() to skip TX queue

draining when

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References