CVE-2026-43276

A use-after-free flaw with moderate security impact was found in the Linux kernel's mana network driver. On the PCI service rescan path, mana_serv_reset() calls mana_gd_suspend(), and mana_gd_cleanup() destroys the gc->service_wq workqueue. If the subsequent mana_gd_resume() fails with -ETIMEDOUT or -EPROTO, the code falls through to mana_serv_rescan(), which triggers pci_stop_and_remove_bus_device(); the resulting PCI remove callback (mana_gd_remove) then calls mana_gd_cleanup() a second time and attempts to destroy the already-freed workqueue. A local attacker on a system using the mana network driver who can trigger this error path could exploit the flaw to crash the kernel, resulting in a denial of service.

This flaw affects Red Hat Enterprise Linux 9 (kernel and kernel-rt in the 9.7, 9.8, and 9.9 update streams), Red Hat Enterprise Linux 10 (kernel in the 10.2 and 10.3 update streams), and Red Hat In-Vehicle OS 2.0, which contain the mana driver code that added support for auxiliary device servicing events. Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.0 through 9.6 update streams, and RHEL 10.0 are not affected because the vulnerable code is not present, and the RHEL 10.1 stream has been assessed as not affected by the responsible team. Fixes for the remaining affected streams are being pursued by the respective product teams; for the RHEL 9.7 update stream the flaw has been marked as won't fix. Red Hat rates this flaw as moderate rather than the NIST CVSS 7.8 (Important) severity because exploitation requires local access and depends on a specific resume failure (-ETIMEDOUT or -EPROTO) during a PCI service rescan, limiting the practical consequence to a local denial of service.