CVE-2026-43276 in Linux
Summary
by MITRE • 05/06/2026
In the Linux kernel, the following vulnerability has been resolved:
net: mana: Fix double destroy_workqueue on service rescan PCI path
While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path.
When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() destroys gc->service_wq. If the subsequent mana_gd_resume() fails with -ETIMEDOUT or -EPROTO, the code falls through to mana_serv_rescan() which triggers pci_stop_and_remove_bus_device(). This invokes the PCI .remove callback (mana_gd_remove), which calls mana_gd_cleanup() a second time, attempting to destroy the already- freed workqueue. Fix this by NULL-checking gc->service_wq in mana_gd_cleanup() and setting it to NULL after destruction.
Call stack of issue for reference: [Sat Feb 21 18:53:48 2026] Call Trace:
[Sat Feb 21 18:53:48 2026]
[Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana]
[Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana]
[Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0
[Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70
[Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250
[Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20
[Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90
[Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30
[Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana]
[Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana]
[Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0
[Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0
[Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130
[Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10
[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10
[Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350
[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10
[Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30
[Sat Feb 21 18:53:48 2026]
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/11/2026
The vulnerability resides within the Linux kernel's network driver implementation for the Microsoft Azure Network Adapter (MANA) device, specifically in the service rescan PCI path handling. This issue manifests as a double free condition involving a workqueue structure that leads to a use-after-free crash scenario. The problem occurs during the device reset and reinitialization sequence where the driver attempts to manage the lifecycle of a workqueue named service_wq in an improper manner. The flaw stems from the lack of proper state management checks during the cleanup phase of the driver's operation, creating a situation where the same memory resource gets freed twice.
The technical root cause involves the interaction between multiple driver functions during device reset operations. When mana_serv_reset() is invoked, it calls mana_gd_suspend() which subsequently calls mana_gd_cleanup() to destroy the gc->service_wq workqueue. However, if the subsequent mana_gd_resume() operation fails with error codes -ETIMEDOUT or -EPROTO, the code path continues to mana_serv_rescan() which then invokes pci_stop_and_remove_bus_device(). This function triggers the PCI .remove callback mana_gd_remove(), which again calls mana_gd_cleanup() on the same workqueue that was already destroyed. This creates a classic double-free scenario that corrupts kernel memory structures and results in system instability.
The operational impact of this vulnerability extends beyond simple system crashes, potentially enabling privilege escalation or denial of service conditions within kernel space. The use-after-free condition can be exploited by malicious actors to corrupt kernel memory, leading to arbitrary code execution or system compromise. The vulnerability affects systems running Linux kernels with the MANA network driver enabled, particularly those managing Azure Network Adapter hardware. The crash occurs during service rescan operations when the driver attempts to reset and reinitialize the device, making it relevant to cloud environments and virtualized systems where such operations might be frequent.
The fix implemented addresses this vulnerability by introducing a NULL check for the gc->service_wq workqueue within the mana_gd_cleanup() function before attempting destruction. Additionally, the code sets the workqueue pointer to NULL after successful destruction, preventing subsequent cleanup operations from attempting to free the same memory region. This approach follows established patterns for preventing double-free conditions in kernel space and aligns with the common practice of setting pointers to NULL after memory deallocation to prevent accidental reuse. The solution directly addresses the flaw identified in the call stack where the sequence of function calls leads to the double destruction of the workqueue structure. This remediation follows the principle of defensive programming and prevents the specific use-after-free condition that was causing the system crashes.
The vulnerability maps to CWE-415: Double Free, which is classified as a memory safety issue in the Common Weakness Enumeration catalog. This weakness represents a critical concern in kernel development where improper resource management can lead to system compromise. The issue also relates to ATT&CK technique T1068: Exploitation for Privilege Escalation, as the use-after-free condition can potentially be leveraged to execute arbitrary code with kernel privileges. The vulnerability demonstrates the importance of proper resource lifecycle management in kernel drivers and highlights the need for comprehensive testing of corner cases in device reset and recovery paths. The fix ensures that the driver properly manages its workqueue resources during both normal operation and error recovery scenarios, thereby maintaining system stability and security.