CVE-2026-23454
published 2026-04-03CVE-2026-23454: In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown A…
PriorityP432high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.12%
2.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
A potential race condition exists in mana_hwc_destroy_channel() where
hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and
Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt
handler to dereference freed memory, leading to a use-after-free or
NULL pointer dereference in mana_hwc_handle_resp().
mana_smc_teardown_hwc() signals the hardware to stop but does not
synchronize against IRQ handlers already executing on other CPUs. The
IRQ synchronization only happens in mana_hwc_destroy_cq() via
mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs
after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler()
can dereference freed caller_ctx (and rxq->msg_buf) in
mana_hwc_handle_resp().
Fix this by reordering teardown to reverse-of-creation order: destroy
the TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx. This
ensures all in-flight interrupt handlers complete before the memory they
access is freed.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.10-1 (forky) | linux 6.19.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f < b88edf12fc3779521ae5f6f1584153b15f7da6df | b88edf12fc3779521ae5f6f1584153b15f7da6df |
| linux | linux | >= ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f < e23bf444512cb85d76012080a76cd1f9e967448e | e23bf444512cb85d76012080a76cd1f9e967448e |
| linux | linux | >= ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f < 249e905571583a434d4ea8d6f92ccc0eef337115 | 249e905571583a434d4ea8d6f92ccc0eef337115 |
| linux | linux | >= ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f < 2b001901f689021acd7bf2dceed74a1bdcaaa1f9 | 2b001901f689021acd7bf2dceed74a1bdcaaa1f9 |
| linux | linux | >= ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f < afdb1533eb9c05432aeb793a7280fa827c502f5c | afdb1533eb9c05432aeb793a7280fa827c502f5c |
| linux | linux | >= ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f < 05d345719d85b927cba74afac4d5322de3aa4256 | 05d345719d85b927cba74afac4d5322de3aa4256 |
| linux | linux | >= ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f < fa103fc8f56954a60699a29215cb713448a39e87 | fa103fc8f56954a60699a29215cb713448a39e87 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.10-1 | 6.19.10-1 |
| linux | linux_kernel | >= 5.13 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.167 | 6.1.167 |
| linux | linux_kernel | >= 6.13 < 6.18.20 | 6.18.20 |
| linux | linux_kernel | >= 6.19 < 6.19.10 | 6.19.10 |
| linux | linux_kernel | >= 6.2 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 6.7 < 6.12.78 | 6.12.78 |
| ubuntu | linux | — | — |
| ubuntu | linux-azure | — | — |
| ubuntu | linux-azure-6.17 | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-gcp-6.8 | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-05-26·CVSS 5.5
CVE-2026-23274 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- S390 architecture;
- Cryptographic API;
- GPU drivers;
- Ethernet bonding driver;
- Microsoft Azure Network Adapter (MANA) driver;
- Network file system (NFS) server daemon;
- Distributed Switch Architecture;
- Netfilter;
- Control group (cgroup);
- K
Red Hat
kernel: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
vendor_redhat·2026-04-03·CVSS 5.5
CVE-2026-23454 [MEDIUM] CWE-825 kernel: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
kernel: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
In the Linux kernel, the following vulnerability has been resolved:
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
A potential race condition exists in mana_hwc_destroy_channel() where
hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and
Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt
handler to dereference freed memory, leading to a use-after-free or
NULL pointer dereference in mana_hwc_handle_resp().
mana_smc_teardown_hwc() signals the hardware to stop but does not
synchronize against IRQ handlers already executing on other CPUs. The
IRQ synchronization only happens in mana_hwc_destroy_cq() via
mana_gd_destroy_eq() -> mana_gd
Debian
CVE-2026-23454: linux - In the Linux kernel, the following vulnerability has been resolved: net: mana: ...
vendor_debian·2026
CVE-2026-23454 CVE-2026-23454: linux - In the Linux kernel, the following vulnerability has been resolved: net: mana: ...
In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown A potential race condition exists in mana_hwc_destroy_channel() where hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt handler to dereference freed memory, leading to a use-after-free or NULL pointer dereference in mana_hwc_handle_resp(). mana_smc_teardown_hwc() signals the hardware to stop but does not synchronize against IRQ handlers already executing on other CPUs. The IRQ synchronization only happens in mana_hwc_destroy_cq() via mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_ev
OSV
CVE-2026-23454: In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
osv·2026-04-03
CVE-2026-23454 CVE-2026-23454: In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown A potential race condition exists in mana_hwc_destroy_channel() where hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt handler to dereference freed memory, leading to a use-after-free or NULL pointer dereference in mana_hwc_handle_resp(). mana_smc_teardown_hwc() signals the hardware to stop but does not synchronize against IRQ handlers already executing on other CPUs. The IRQ synchronization only happens in mana_hwc_destroy_cq() via mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_ev
GHSA
GHSA-v535-7p5c-7xm9: In the Linux kernel, the following vulnerability has been resolved:
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardow
ghsa_unreviewed·2026-04-03
CVE-2026-23454 GHSA-v535-7p5c-7xm9: In the Linux kernel, the following vulnerability has been resolved:
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardow
In the Linux kernel, the following vulnerability has been resolved:
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
A potential race condition exists in mana_hwc_destroy_channel() where
hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and
Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt
handler to dereference freed memory, leading to a use-after-free or
NULL pointer dereference in mana_hwc_handle_resp().
mana_smc_teardown_hwc() signals the hardware to stop but does not
synchronize against IRQ handlers already executing on other CPUs. The
IRQ synchronization only happens in mana_hwc_destroy_cq() via
mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs
after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-23454 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-23454 CVE-2026-23454 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23454 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
A potential race condition exists in mana_hwc_destroy_channel() where
hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and
Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt
handler to dereference freed memory, leading to a use-after-free or
NULL pointer dereference in mana_hwc_handle_resp().
mana_smc_teardown_hwc() signals the hardware to stop but does not
synchronize against IRQ handlers already executing on other CPUs. The
IRQ synchronization only happens in mana_hwc_destroy_cq() via
mana_gd_destroy_eq() -> mana_gd_deregister_irq(
Bugzilla
CVE-2026-23454 kernel: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
bugzilla·2026-04-03·CVSS 7.0
CVE-2026-23454 [HIGH] CVE-2026-23454 kernel: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
CVE-2026-23454 kernel: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
In the Linux kernel, the following vulnerability has been resolved:
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
A potential race condition exists in mana_hwc_destroy_channel() where
hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and
Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt
handler to dereference freed memory, leading to a use-after-free or
NULL pointer dereference in mana_hwc_handle_resp().
mana_smc_teardown_hwc() signals the hardware to stop but does not
synchronize against IRQ handlers already executing on other CPUs. The
IRQ synchronization only happens in mana_hwc_destroy_cq() via
mana_gd_destr
https://git.kernel.org/stable/c/05d345719d85b927cba74afac4d5322de3aa4256https://git.kernel.org/stable/c/249e905571583a434d4ea8d6f92ccc0eef337115https://git.kernel.org/stable/c/2b001901f689021acd7bf2dceed74a1bdcaaa1f9https://git.kernel.org/stable/c/afdb1533eb9c05432aeb793a7280fa827c502f5chttps://git.kernel.org/stable/c/b88edf12fc3779521ae5f6f1584153b15f7da6dfhttps://git.kernel.org/stable/c/e23bf444512cb85d76012080a76cd1f9e967448ehttps://git.kernel.org/stable/c/fa103fc8f56954a60699a29215cb713448a39e87https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
2026-04-03
Published