CVE-2026-43276

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: mana: Fix double destroy_workqueue on service rescan PCI path<br /> <br /> While testing corner cases in the driver, a use-after-free crash<br /> was found on the service rescan PCI path.<br /> <br /> When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup()<br /> destroys gc-&gt;service_wq. If the subsequent mana_gd_resume() fails<br /> with -ETIMEDOUT or -EPROTO, the code falls through to<br /> mana_serv_rescan() which triggers pci_stop_and_remove_bus_device().<br /> This invokes the PCI .remove callback (mana_gd_remove), which calls<br /> mana_gd_cleanup() a second time, attempting to destroy the already-<br /> freed workqueue. Fix this by NULL-checking gc-&gt;service_wq in<br /> mana_gd_cleanup() and setting it to NULL after destruction.<br /> <br /> Call stack of issue for reference:<br /> [Sat Feb 21 18:53:48 2026] Call Trace:<br /> [Sat Feb 21 18:53:48 2026] <br /> [Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana]<br /> [Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana]<br /> [Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0<br /> [Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70<br /> [Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250<br /> [Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20<br /> [Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90<br /> [Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30<br /> [Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana]<br /> [Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana]<br /> [Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0<br /> [Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0<br /> [Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130<br /> [Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10<br /> [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10<br /> [Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350<br /> [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10<br /> [Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30<br /> [Sat Feb 21 18:53:48 2026]