---
id: CVE-2026-43276
title: 'net: mana: Fix double destroy_workqueue on service rescan PCI path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: mana: Fix double destroy_workqueue on service rescan PCI path

  While testing corner cases in the driver, a use-after-free crash
  was found on the service rescan PCI…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 505cc26bcae00699bacaee66cd50ede7a9cc89cb <
    fa3c2f8d9152344a478abb847081c1b5f84a94f5
  - >-
    Linux >= 505cc26bcae00699bacaee66cd50ede7a9cc89cb <
    a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e
  - >-
    Linux >= 505cc26bcae00699bacaee66cd50ede7a9cc89cb <
    f975a0955276579e2176a134366ed586071c7c6a
  - Linux 6.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:33:05.623184Z'
published: '2026-05-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:46.252Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43276'
references:
  - url: 'https://git.kernel.org/stable/c/fa3c2f8d9152344a478abb847081c1b5f84a94f5'
  - url: 'https://git.kernel.org/stable/c/a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e'
  - url: 'https://git.kernel.org/stable/c/f975a0955276579e2176a134366ed586071c7c6a'
tags:
  - cve.org
epss: 0.00118
epssPercentile: 0.01711
ingestedAt: '2026-11-06T15:54:03.951Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Fix double destroy_workqueue on service rescan PCI path

While testing corner cases in the driver, a use-after-free crash
was found on the service rescan PCI path.

When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup()
destroys gc->service_wq. If the subsequent mana_gd_resume() fails
with -ETIMEDOUT or -EPROTO, the code falls through to
mana_serv_rescan() which triggers pci_stop_and_remove_bus_device().
This invokes the PCI .remove callback (mana_gd_remove), which calls
mana_gd_cleanup() a second time, attempting to destroy the already-
freed workqueue. Fix this by NULL-checking gc->service_wq in
mana_gd_cleanup() and setting it to NULL after destruction.

Call stack of issue for reference:
[Sat Feb 21 18:53:48 2026] Call Trace:
[Sat Feb 21 18:53:48 2026]  <TASK>
[Sat Feb 21 18:53:48 2026]  mana_gd_cleanup+0x33/0x70 [mana]
[Sat Feb 21 18:53:48 2026]  mana_gd_remove+0x3a/0xc0 [mana]
[Sat Feb 21 18:53:48 2026]  pci_device_remove+0x41/0xb0
[Sat Feb 21 18:53:48 2026]  device_remove+0x46/0x70
[Sat Feb 21 18:53:48 2026]  device_release_driver_internal+0x1e3/0x250
[Sat Feb 21 18:53:48 2026]  device_release_driver+0x12/0x20
[Sat Feb 21 18:53:48 2026]  pci_stop_bus_device+0x6a/0x90
[Sat Feb 21 18:53:48 2026]  pci_stop_and_remove_bus_device+0x13/0x30
[Sat Feb 21 18:53:48 2026]  mana_do_service+0x180/0x290 [mana]
[Sat Feb 21 18:53:48 2026]  mana_serv_func+0x24/0x50 [mana]
[Sat Feb 21 18:53:48 2026]  process_one_work+0x190/0x3d0
[Sat Feb 21 18:53:48 2026]  worker_thread+0x16e/0x2e0
[Sat Feb 21 18:53:48 2026]  kthread+0xf7/0x130
[Sat Feb 21 18:53:48 2026]  ? __pfx_worker_thread+0x10/0x10
[Sat Feb 21 18:53:48 2026]  ? __pfx_kthread+0x10/0x10
[Sat Feb 21 18:53:48 2026]  ret_from_fork+0x269/0x350
[Sat Feb 21 18:53:48 2026]  ? __pfx_kthread+0x10/0x10
[Sat Feb 21 18:53:48 2026]  ret_from_fork_asm+0x1a/0x30
[Sat Feb 21 18:53:48 2026]  </TASK>

## Affected

- `Linux >= 505cc26bcae00699bacaee66cd50ede7a9cc89cb < fa3c2f8d9152344a478abb847081c1b5f84a94f5`
- `Linux >= 505cc26bcae00699bacaee66cd50ede7a9cc89cb < a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e`
- `Linux >= 505cc26bcae00699bacaee66cd50ede7a9cc89cb < f975a0955276579e2176a134366ed586071c7c6a`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.