In the Linux kernel, the following vulnerability has been resolved:
net: mana: Fix double destroy_workqueue on service rescan PCI path
While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path.
When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() destroys gc->service_wq. If the subsequent mana_gd_resume() fails with -ETIMEDOUT or -EPROTO, the code falls through to mana_serv_rescan() which triggers pci_stop_and_remove_bus_device(). This invokes the PCI .remove callback (mana_gd_remove), which calls mana_gd_cleanup() a second time, attempting to destroy the already- freed workqueue. Fix this by NULL-checking gc->service_wq in mana_gd_cleanup() and setting it to NULL after destruction.
Call stack of issue for reference: [Sat Feb 21 18:53:48 2026] Call Trace: [Sat Feb 21 18:53:48 2026] <TASK> [Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana] [Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana] [Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0 [Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70 [Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250 [Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20 [Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90 [Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30 [Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana] [Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana] [Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0 [Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0 [Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130 [Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350 [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30 [Sat Feb 21 18:53:48 2026] </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-64k-modulesUpgrade kernel-tools-libs-develUpgrade kernel-64k-modulesUpgrade kernel-rt-64k-debugUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-64k-debugUpgrade kernel-rt-modules-coreUpgrade kernel-toolsUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64kUpgrade kernel-rtUpgrade kernel-abi-stablelistsUpgrade libperfUpgrade rvUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-headersUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-64kUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libsUpgrade kernel-rt-debugUpgrade python3-perfUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-develUpgrade kernelUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-docUpgrade kernel-64k-debug-develUpgrade kernel-rt-64k-coreUpgrade kernel-rt-coreUpgrade kernel-64k-debug-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade rtlaUpgrade kernel-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-debug-modules-coreUpgrade kernel-modulesUpgrade perfUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-develUpgrade kernel-64k-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-develUpgrade kernel-debug-develUpgrade kernel-develUpgrade kernel-zfcpdump-develUpgrade kernel-cross-headers | Jul 9, 2026 | Jul 6, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jul 8, 2026 | May 6, 2026 |
| Rocky_linux | — | Upgrade kernel-debug-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-tools-libsUpgrade kernel-debugUpgrade kernel-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-zfcpdumpUpgrade kernel-debug-develUpgrade rtlaUpgrade kernel-tools-debuginfoUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-develUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-debuginfo-common-s390xUpgrade kernel-tools-libs-develUpgrade libperfUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernelUpgrade kernel-modules-coreUpgrade kernel-debug-devel-matchedUpgrade rvUpgrade kernel-devel-matchedUpgrade python3-perfUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade perfUpgrade kernel-zfcpdump-modules-coreUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade libperf-debuginfo | Jul 13, 2026 | Jul 11, 2026 |
| Ubuntu | — | Upgrade linux-image-6.17.0-1015-azureUpgrade linux-image-azure-6.17Upgrade linux-image-azure | May 27, 2026 | May 26, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub