CVE-2026-23454

A flaw was found in the Linux kernel's mana network driver. A race condition during the destruction of a hardware completion queue (HWC) channel can lead to memory being freed while still in use. This use-after-free vulnerability allows an in-flight interrupt handler to dereference freed memory. This could potentially result in a system crash, leading to a Denial of Service (DoS), or in more severe cases, arbitrary code execution.

Teardown freed caller_ctx before CQ/EQ IRQ teardown completed, so mana_hwc_handle_resp() could run on freed memory. Affects Microsoft Azure MANA virtio paths. Reordering teardown closes the window; treat primary impact as kernel crash until proven otherwise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.