CVE-2026-53297 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: mana: Guard mana_remove against double invocation If PM resume fails (e.g., mana_attach() returns an error), mana_probe() calls mana_remove(), which tears down the device and sets gd->gdma_context = NULL and gd->driver_data = NULL. However, a failed resume callback does not automatically unbind the driver. When the device is eventually unbound, mana_remove() is invoked a second time. Without a NULL check, it dereferences gc->dev with gc == NULL, causing a kernel panic. Add an early return if gdma_context or driver_data is NULL so the second invocation is harmless. Move the dev = gc->dev assignment after the guard so it cannot dereference NULL.
A vulnerability in the Linux kernel's net: mana driver allows for a double invocation of the mana_remove() function, which can lead to a kernel panic. This issue occurs when the power management resume process fails, causing mana_probe() to call mana_remove() and nullify certain context data. However, the driver remains bound, and when the device is unbound later, mana_remove() is called again. Without a check for null values, this second invocation dereferences a null context, causing a crash. The vulnerability affects the Linux kernel stable tree.
The vulnerability has been addressed in the Linux kernel. Users can apply the latest patches available in the Linux kernel stable tree to mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/50271d7ec95144d26808025b508f463780517d3c | kernel.org | Patch |
| https://git.kernel.org/stable/c/a1ddfd2c0b7a48e5239fadd2a24cc4bc2cda90e6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/bbe5c3c570645a4ceb120979d3ee203a1583d775 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.16, < 6.18.33 >= 6.19, < 7.0.10 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | New CVE Received | kernel.org |