In the Linux kernel, the following vulnerability has been resolved:
net: mana: Fix double destroy_workqueue on service rescan PCI path
While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path.
When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() destroys gc->service_wq. If the subsequent mana_gd_resume() fails with -ETIMEDOUT or -EPROTO, the code falls through to mana_serv_rescan() which triggers pci_stop_and_remove_bus_device(). This invokes the PCI .remove callback (mana_gd_remove), which calls mana_gd_cleanup() a second time, attempting to destroy the already- freed workqueue. Fix this by NULL-checking gc->service_wq in mana_gd_cleanup() and setting it to NULL after destruction.
Call stack of issue for reference: [Sat Feb 21 18:53:48 2026] Call Trace: [Sat Feb 21 18:53:48 2026] <TASK> [Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana] [Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana] [Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0 [Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70 [Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250 [Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20 [Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90 [Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30 [Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana] [Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana] [Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0 [Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0 [Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130 [Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350 [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30 [Sat Feb 21 18:53:48 2026] </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-uki-virtUpgrade kernel-rt-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-debug-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade kernel-rt-64kUpgrade kernel-abi-stablelistsUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-modulesUpgrade kernel-rt-64k-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64k-debugUpgrade kernel-64k-debugUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modulesUpgrade rvUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-devel-matchedUpgrade kernel-rt-64k-debug-coreUpgrade kernel-zfcpdumpUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-64k-modules-coreUpgrade kernel-modules-coreUpgrade kernel-tools-libs-develUpgrade libperfUpgrade kernel-rtUpgrade kernel-rt-64k-modules-extraUpgrade kernel-64kUpgrade kernel-64k-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-headersUpgrade kernel-docUpgrade kernel-rt-64k-develUpgrade kernel-develUpgrade python3-perfUpgrade kernel-64k-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-coreUpgrade kernel-rt-debug-develUpgrade kernelUpgrade kernel-rt-develUpgrade kernel-debug-develUpgrade kernel-64k-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-64k-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade perfUpgrade kernel-modulesUpgrade kernel-rt-debugUpgrade kernel-64k-debug-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-64k-coreUpgrade rtlaUpgrade kernel-cross-headers | Jul 9, 2026 | Jul 6, 2026 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 8, 2026 | May 6, 2026 |
| Rocky_linux | — | Upgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade rvUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-toolsUpgrade libperf-debuginfoUpgrade kernel-debuginfo-common-s390xUpgrade kernelUpgrade kernel-uki-virt-addonsUpgrade libperfUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade python3-perfUpgrade kernel-debug-devel-matchedUpgrade kernel-tools-libs-develUpgrade perfUpgrade perf-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdumpUpgrade kernel-coreUpgrade kernel-tools-libsUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-extraUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-debugUpgrade rtlaUpgrade kernel-develUpgrade kernel-debug-debuginfoUpgrade kernel-debug-coreUpgrade kernel-modulesUpgrade kernel-tools-debuginfoUpgrade kernel-debug-develUpgrade kernel-uki-virtUpgrade kernel-debug-modules | Jul 13, 2026 | Jul 11, 2026 |
| Ubuntu | — | Upgrade linux-image-azure-6.17Upgrade linux-image-azureUpgrade linux-image-6.17.0-1015-azure | May 27, 2026 | May 26, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub