CVE-2026-23454

In the Linux kernel's MANA driver, a race condition exists in mana_hwc_destroy_channel() where the hwc->caller_ctx memory is freed via kfree() before the hardware Completion Queue (CQ) and Event Queue (EQ) are torn down. This can lead to a use-after-free vulnerability when an in-flight CQ interrupt handler, mana_hwc_handle_resp(), dereferences the freed caller_ctx or adjacent buffers.

The root cause is that mana_smc_teardown_hwc() signals the hardware to stop but does not synchronize against interrupt handlers already executing on other CPUs. The required interrupt synchronization only happens later, inside mana_hwc_destroy_cq() -> mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this synchronization call occurs after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler() can still access the freed memory, resulting in memory corruption or a crash.

An attacker who can trigger a MANA channel teardown (e.g., during device reset or namespace removal) may cause a kernel panic or, potentially, gain further privileges if the freed memory is repurposed. The vulnerability can be triggered without special privileges if the attack vector is reachable from unprivileged contexts, though the exact prerequisites depend on the system configuration.

The fix reorders the teardown sequence to follow the reverse of the creation order: TX and RX work queues are destroyed first, then the CQ and EQ, and finally hwc->caller_ctx is freed. This ensures all interrupt handlers complete before the memory they access is released [1][2][3][4]. Patched versions of the Linux kernel are available; users should update to the latest stable kernels to mitigate this issue.