{"id":"CVE-2026-43276","summary":"net: mana: Fix double destroy_workqueue on service rescan PCI path","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix double destroy_workqueue on service rescan PCI path\n\nWhile testing corner cases in the driver, a use-after-free crash\nwas found on the service rescan PCI path.\n\nWhen mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup()\ndestroys gc-\u003eservice_wq. If the subsequent mana_gd_resume() fails\nwith -ETIMEDOUT or -EPROTO, the code falls through to\nmana_serv_rescan() which triggers pci_stop_and_remove_bus_device().\nThis invokes the PCI .remove callback (mana_gd_remove), which calls\nmana_gd_cleanup() a second time, attempting to destroy the already-\nfreed workqueue. Fix this by NULL-checking gc-\u003eservice_wq in\nmana_gd_cleanup() and setting it to NULL after destruction.\n\nCall stack of issue for reference:\n[Sat Feb 21 18:53:48 2026] Call Trace:\n[Sat Feb 21 18:53:48 2026]  \u003cTASK\u003e\n[Sat Feb 21 18:53:48 2026]  mana_gd_cleanup+0x33/0x70 [mana]\n[Sat Feb 21 18:53:48 2026]  mana_gd_remove+0x3a/0xc0 [mana]\n[Sat Feb 21 18:53:48 2026]  pci_device_remove+0x41/0xb0\n[Sat Feb 21 18:53:48 2026]  device_remove+0x46/0x70\n[Sat Feb 21 18:53:48 2026]  device_release_driver_internal+0x1e3/0x250\n[Sat Feb 21 18:53:48 2026]  device_release_driver+0x12/0x20\n[Sat Feb 21 18:53:48 2026]  pci_stop_bus_device+0x6a/0x90\n[Sat Feb 21 18:53:48 2026]  pci_stop_and_remove_bus_device+0x13/0x30\n[Sat Feb 21 18:53:48 2026]  mana_do_service+0x180/0x290 [mana]\n[Sat Feb 21 18:53:48 2026]  mana_serv_func+0x24/0x50 [mana]\n[Sat Feb 21 18:53:48 2026]  process_one_work+0x190/0x3d0\n[Sat Feb 21 18:53:48 2026]  worker_thread+0x16e/0x2e0\n[Sat Feb 21 18:53:48 2026]  kthread+0xf7/0x130\n[Sat Feb 21 18:53:48 2026]  ? __pfx_worker_thread+0x10/0x10\n[Sat Feb 21 18:53:48 2026]  ? __pfx_kthread+0x10/0x10\n[Sat Feb 21 18:53:48 2026]  ret_from_fork+0x269/0x350\n[Sat Feb 21 18:53:48 2026]  ? __pfx_kthread+0x10/0x10\n[Sat Feb 21 18:53:48 2026]  ret_from_fork_asm+0x1a/0x30\n[Sat Feb 21 18:53:48 2026]  \u003c/TASK\u003e","modified":"2026-05-28T03:54:39.714037055Z","published":"2026-05-06T11:28:58.840Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43276.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f975a0955276579e2176a134366ed586071c7c6a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fa3c2f8d9152344a478abb847081c1b5f84a94f5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43276.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43276"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"505cc26bcae00699bacaee66cd50ede7a9cc89cb"},{"fixed":"fa3c2f8d9152344a478abb847081c1b5f84a94f5"},{"fixed":"a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e"},{"fixed":"f975a0955276579e2176a134366ed586071c7c6a"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-43276.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.16.0"},{"fixed":"6.18.16"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-43276.json"}}],"schema_version":"1.7.5"}