CVE-2026-43276

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43276", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.998Z", "datePublished": "2026-05-06T11:28:58.840Z", "dateUpdated": "2026-11-06T15:42:46.252Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:21:25.701Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix double destroy_workqueue on service rescan PCI path\n\nWhile testing corner cases in the driver, a use-after-free crash\nwas found on the service rescan PCI path.\n\nWhen mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup()\ndestroys gc->service_wq. If the subsequent mana_gd_resume() fails\nwith -ETIMEDOUT or -EPROTO, the code falls through to\nmana_serv_rescan() which triggers pci_stop_and_remove_bus_device().\nThis invokes the PCI .remove callback (mana_gd_remove), which calls\nmana_gd_cleanup() a second time, attempting to destroy the already-\nfreed workqueue. Fix this by NULL-checking gc->service_wq in\nmana_gd_cleanup() and setting it to NULL after destruction.\n\nCall stack of issue for reference:\n[Sat Feb 21 18:53:48 2026] Call Trace:\n[Sat Feb 21 18:53:48 2026] <TASK>\n[Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana]\n[Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana]\n[Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0\n[Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70\n[Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250\n[Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20\n[Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90\n[Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30\n[Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana]\n[Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana]\n[Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0\n[Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0\n[Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130\n[Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10\n[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10\n[Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350\n[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10\n[Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30\n[Sat Feb 21 18:53:48 2026] </TASK>"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microsoft/mana/gdma_main.c", "drivers/net/ethernet/microsoft/mana/mana_en.c"], "versions": [{"version": "505cc26bcae00699bacaee66cd50ede7a9cc89cb", "lessThan": "fa3c2f8d9152344a478abb847081c1b5f84a94f5", "status": "affected", "versionType": "git"}, {"version": "505cc26bcae00699bacaee66cd50ede7a9cc89cb", "lessThan": "a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e", "status": "affected", "versionType": "git"}, {"version": "505cc26bcae00699bacaee66cd50ede7a9cc89cb", "lessThan": "f975a0955276579e2176a134366ed586071c7c6a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microsoft/mana/gdma_main.c", "drivers/net/ethernet/microsoft/mana/mana_en.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fa3c2f8d9152344a478abb847081c1b5f84a94f5"}, {"url": "https://git.kernel.org/stable/c/a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e"}, {"url": "https://git.kernel.org/stable/c/f975a0955276579e2176a134366ed586071c7c6a"}], "title": "net: mana: Fix double destroy_workqueue on service rescan PCI path", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43276", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:33:05.623184Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:42:46.252Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43276", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:33:05.623184Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:33:07.039Z"}}], "cna": {"title": "net: mana: Fix double destroy_workqueue on service rescan PCI path", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "505cc26bcae00699bacaee66cd50ede7a9cc89cb", "lessThan": "fa3c2f8d9152344a478abb847081c1b5f84a94f5", "versionType": "git"}, {"status": "affected", "version": "505cc26bcae00699bacaee66cd50ede7a9cc89cb", "lessThan": "a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e", "versionType": "git"}, {"status": "affected", "version": "505cc26bcae00699bacaee66cd50ede7a9cc89cb", "lessThan": "f975a0955276579e2176a134366ed586071c7c6a", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/microsoft/mana/gdma_main.c", "drivers/net/ethernet/microsoft/mana/mana_en.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/microsoft/mana/gdma_main.c", "drivers/net/ethernet/microsoft/mana/mana_en.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/fa3c2f8d9152344a478abb847081c1b5f84a94f5"}, {"url": "https://git.kernel.org/stable/c/a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e"}, {"url": "https://git.kernel.org/stable/c/f975a0955276579e2176a134366ed586071c7c6a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix double destroy_workqueue on service rescan PCI path\n\nWhile testing corner cases in the driver, a use-after-free crash\nwas found on the service rescan PCI path.\n\nWhen mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup()\ndestroys gc->service_wq. If the subsequent mana_gd_resume() fails\nwith -ETIMEDOUT or -EPROTO, the code falls through to\nmana_serv_rescan() which triggers pci_stop_and_remove_bus_device().\nThis invokes the PCI .remove callback (mana_gd_remove), which calls\nmana_gd_cleanup() a second time, attempting to destroy the already-\nfreed workqueue. Fix this by NULL-checking gc->service_wq in\nmana_gd_cleanup() and setting it to NULL after destruction.\n\nCall stack of issue for reference:\n[Sat Feb 21 18:53:48 2026] Call Trace:\n[Sat Feb 21 18:53:48 2026] <TASK>\n[Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana]\n[Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana]\n[Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0\n[Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70\n[Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250\n[Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20\n[Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90\n[Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30\n[Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana]\n[Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana]\n[Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0\n[Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0\n[Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130\n[Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10\n[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10\n[Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350\n[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10\n[Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30\n[Sat Feb 21 18:53:48 2026] </TASK>"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:21:25.701Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43276", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:42:46.252Z", "dateReserved": "2026-05-01T14:12:55.998Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-06T11:28:58.840Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/microsoft/mana/gdma_main.c", "drivers/net/ethernet/microsoft/mana/mana_en.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fa3c2f8d9152344a478abb847081c1b5f84a94f5", "status": "affected", "version": "505cc26bcae00699bacaee66cd50ede7a9cc89cb", "versionType": "git"}, {"lessThan": "a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e", "status": "affected", "version": "505cc26bcae00699bacaee66cd50ede7a9cc89cb", "versionType": "git"}, {"lessThan": "f975a0955276579e2176a134366ed586071c7c6a", "status": "affected", "version": "505cc26bcae00699bacaee66cd50ede7a9cc89cb", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/microsoft/mana/gdma_main.c", "drivers/net/ethernet/microsoft/mana/mana_en.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4562EDA-AFEA-4C62-97CC-C83E109A5F19", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix double destroy_workqueue on service rescan PCI path\n\nWhile testing corner cases in the driver, a use-after-free crash\nwas found on the service rescan PCI path.\n\nWhen mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup()\ndestroys gc->service_wq. If the subsequent mana_gd_resume() fails\nwith -ETIMEDOUT or -EPROTO, the code falls through to\nmana_serv_rescan() which triggers pci_stop_and_remove_bus_device().\nThis invokes the PCI .remove callback (mana_gd_remove), which calls\nmana_gd_cleanup() a second time, attempting to destroy the already-\nfreed workqueue. Fix this by NULL-checking gc->service_wq in\nmana_gd_cleanup() and setting it to NULL after destruction.\n\nCall stack of issue for reference:\n[Sat Feb 21 18:53:48 2026] Call Trace:\n[Sat Feb 21 18:53:48 2026] <TASK>\n[Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana]\n[Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana]\n[Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0\n[Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70\n[Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250\n[Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20\n[Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90\n[Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30\n[Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana]\n[Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana]\n[Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0\n[Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0\n[Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130\n[Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10\n[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10\n[Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350\n[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10\n[Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30\n[Sat Feb 21 18:53:48 2026] </TASK>"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: mana: Corregir doble destroy_workqueue en la ruta PCI de reescaneo de servicio\n\nMientras se probaban casos extremos en el controlador, se encontr\u00f3 un fallo de uso despu\u00e9s de liberaci\u00f3n en la ruta PCI de reescaneo de servicio.\n\nCuando mana_serv_reset() llama a mana_gd_suspend(), mana_gd_cleanup() destruye gc -> service_wq. Si el subsiguiente mana_gd_resume() falla con -ETIMEDOUT o -EPROTO, el c\u00f3digo pasa a mana_serv_rescan(), lo que activa pci_stop_and_remove_bus_device(). Esto invoca la llamada de retorno .remove de PCI (mana_gd_remove), que llama a mana_gd_cleanup() una segunda vez, intentando destruir la workqueue ya liberada. Esto se corrige verificando si gc -> service_wq es NULL en mana_gd_cleanup() y estableci\u00e9ndolo en NULL despu\u00e9s de la destrucci\u00f3n.\n\nPila de llamadas del problema para referencia:\n[S\u00e1b Feb 21 18:53:48 2026] Traza de Llamada:\n[S\u00e1b Feb 21 18:53:48 2026] [TAREA]\n[S\u00e1b Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana]\n[S\u00e1b Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana]\n[S\u00e1b Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0\n[S\u00e1b Feb 21 18:53:48 2026] device_remove+0x46/0x70\n[S\u00e1b Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250\n[S\u00e1b Feb 21 18:53:48 2026] device_release_driver+0x12/0x20\n[S\u00e1b Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90\n[S\u00e1b Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30\n[S\u00e1b Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana]\n[S\u00e1b Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana]\n[S\u00e1b Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0\n[S\u00e1b Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0\n[S\u00e1b Feb 21 18:53:48 2026] kthread+0xf7/0x130\n[S\u00e1b Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10\n[S\u00e1b Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10\n[S\u00e1b Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350\n[S\u00e1b Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10\n[S\u00e1b Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30\n[S\u00e1b Feb 21 18:53:48 2026] [/TAREA]"}], "id": "CVE-2026-43276", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43276", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:33:05.623184Z", "version": "2.0.3"}}]}, "published": "2026-05-06T12:16:48.930", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f975a0955276579e2176a134366ed586071c7c6a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fa3c2f8d9152344a478abb847081c1b5f84a94f5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path", "id": "2467113", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467113"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["A flaw was found in the Linux kernel's mana network driver. This vulnerability, a use-after-free, occurs when the PCI service rescan path attempts to destroy an already-freed workqueue a second time. A local attacker could exploit this condition to cause a system crash, leading to a denial of service."], "name": "CVE-2026-43276", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43276\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43276\nhttps://lore.kernel.org/linux-cve-announce/2026050612-CVE-2026-43276-907b@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[505cc26bcae00699bacaee66cd50ede7a9cc89cb,fa3c2f8d9152344a478abb847081c1b5f84a94f5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[505cc26bcae00699bacaee66cd50ede7a9cc89cb,a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[505cc26bcae00699bacaee66cd50ede7a9cc89cb,f975a0955276579e2176a134366ed586071c7c6a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.16,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T16:15:06.979839+00:00", "updated": "2026-05-08T21:00:10.214817+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}