PT-2026-61290 · Linux · Linux
CVE-2026-63973
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net: mana: Add NULL guards in teardown path to prevent panic on attach failure
When queue allocation fails partway through, the error cleanup frees
and NULLs apc->tx qp and apc->rxqs. Multiple teardown paths such as
mana remove(), mana change mtu() recovery, and internal error handling
in mana alloc queues() can subsequently call into functions that
dereference these pointers without NULL checks:
- mana chn setxdp() dereferences apc->rxqs[0], causing a NULL pointer dereference panic (CR2: 0000000000000000 at mana chn setxdp+0x26).
- mana destroy vport() iterates apc->rxqs without a NULL check.
- mana fence rqs() iterates apc->rxqs without a NULL check.
- mana dealloc queues() iterates apc->tx qp without a NULL check.
Add NULL guards for apc->rxqs in mana fence rqs(),
mana destroy vport(), and before the mana chn setxdp() call. Add a
NULL guard for apc->tx qp in mana dealloc queues() to skip TX queue
draining when TX queues were never allocated or already freed.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux