CVE-2026-63972
Received Received - Intake

Double Free in Linux Kernel's Mana Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When mana_per_port_queue_reset_work_handler() runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc->tx_qp and apc->rxqs already freed. Calling mana_detach() again unconditionally leads to NULL pointer dereferences during queue teardown. Add an early exit in mana_detach() when the port is already in detached state (!netif_device_present) for non-close callers, making it safe to call idempotently. This allows the queue reset handler and other recovery paths to simply retry mana_attach() without redundant teardown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63972
EUVD
EUVD-2026-45745

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a NULL pointer dereference issue in the mana network driver. When a port reset operation runs after a failed attach attempt, the system incorrectly tries to detach an already detached port. This leads to accessing freed memory during queue cleanup, causing crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's mana driver for network devices. Detection requires checking kernel logs for NULL pointer dereferences in mana_detach() or mana_per_port_queue_reset_work_handler() during port detach/attach operations.

Impact Analysis

This could cause system instability or crashes when network operations fail and recovery attempts are made. Systems using the mana driver may experience kernel panics or unexpected reboots during network port resets.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to network device management that could lead to system instability or crashes but does not involve data breaches or unauthorized access.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this issue. Monitor kernel logs for related errors and ensure the mana driver is properly handling port detach/attach sequences.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63972. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart