Medium 5.5Published Jun 26, 2026

CVE-2026-53297net: mana: Guard mana_remove against double invocation

Updated under an hour ago (Oct 27, 2026, 9:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: mana: Guard mana_remove against double invocation If PM resume fails (e.g., mana_attach() returns an error), mana_probe() calls mana_remove(), which tears down the device and sets gd->gdma_context = NULL and gd->driver_data = NULL. However, a failed resume callback does not automatically unbind the driver. When the device is eventually unbound, mana_remove() is invoked a second time. Without a NULL check, it dereferences gc->dev with gc == NULL, causing a kernel panic. Add an early return if gdma_context or driver_data is NULL so the second invocation is harmless. Move the dev = gc->dev assignment after the guard so it cannot dereference NULL.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	635096a86edb067d55a1e04b4a918f5c6dac0c51 builds before 793bf1f4e469c51d0e39199823da5e1de85a2741; 635096a86edb067d55a1e04b4a918f5c6dac0c51 builds before 8ee85b75a72216c857c39457f6595709c4c9f856; from 635096a86edb067d55a1e04b4a918f5c6dac0c51 before a1ddfd2c0b7a48e5239fadd2a24cc4bc2cda90e6; from 635096a86edb067d55a1e04b4a918f5c6dac0c51 before bbe5c3c570645a4ceb120979d3ee203a1583d775; 635096a86edb067d55a1e04b4a918f5c6dac0c51 builds before 50271d7ec95144d26808025b508f463780517d3c	CNA record
linux linux_kernel linux:linux_kernel	from 5.16 before 6.18.33; from 6.19 before 7.0.10	NVD

References

References

https://git.kernel.org/stable/c/793bf1f4e469c51d0e39199823da5e1de85a2741
https://git.kernel.org/stable/c/8ee85b75a72216c857c39457f6595709c4c9f856
https://git.kernel.org/stable/c/a1ddfd2c0b7a48e5239fadd2a24cc4bc2cda90e6	patch
https://git.kernel.org/stable/c/bbe5c3c570645a4ceb120979d3ee203a1583d775	patch
https://git.kernel.org/stable/c/50271d7ec95144d26808025b508f463780517d3c	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.