CVE-2026-23454

In the Linux kernel, the following vulnerability has been resolved:

net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown

A potential race condition exists in mana_hwc_destroy_channel() where hwc->caller_ctx is freed before the HWCs Completion Queue (CQ) and Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt handler to dereference freed memory, leading to a use-after-free or NULL pointer dereference in mana_hwc_handle_resp().

mana_smc_teardown_hwc() signals the hardware to stop but does not synchronize against IRQ handlers already executing on other CPUs. The IRQ synchronization only happens in mana_hwc_destroy_cq() via mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler() can dereference freed caller_ctx (and rxq->msg_buf) in mana_hwc_handle_resp().

Fix this by reordering teardown to reverse-of-creation order: destroy the TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx. This ensures all in-flight interrupt handlers complete before the memory they access is freed.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/05d345719d85b927cba74afac4d5322de3aa4256
• https://git.kernel.org/stable/c/249e905571583a434d4ea8d6f92ccc0eef337115
• https://git.kernel.org/stable/c/2b001901f689021acd7bf2dceed74a1bdcaaa1f9
• https://git.kernel.org/stable/c/afdb1533eb9c05432aeb793a7280fa827c502f5c
• https://git.kernel.org/stable/c/b88edf12fc3779521ae5f6f1584153b15f7da6df
• https://git.kernel.org/stable/c/e23bf444512cb85d76012080a76cd1f9e967448e
• https://git.kernel.org/stable/c/fa103fc8f56954a60699a29215cb713448a39e87