CVE-2026-43056
Use-After-Free in Linux Kernel's mana Driver
Publication date: 2026-05-01
Last updated on: 2026-05-07
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.22 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.12 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.81 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.134 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free issue in the Linux kernel's net subsystem, specifically in the mana driver within the add_adev() function.
When the function auxiliary_device_add() fails, add_adev() jumps to an error handling path where it calls auxiliary_device_uninit() on the auxiliary device.
The auxiliary device's release callback frees the memory of the containing structure (mana_adev). Since the code later tries to access the freed memory (adev->id), this results in a use-after-free vulnerability.
The fix involves saving the auxiliary device id before calling auxiliary_device_add() and using this saved id during cleanup to avoid accessing freed memory.
How can this vulnerability impact me? :
A use-after-free vulnerability can lead to undefined behavior including system crashes, data corruption, or potential escalation of privileges if exploited.
In this specific case, an attacker or a faulty process could trigger the error path in add_adev(), causing the kernel to access freed memory, which might be leveraged to compromise system stability or security.