CVE-2026-23454

In the Linux kernel, the following vulnerability has been resolved:

net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown

A potential race condition exists in mana_hwc_destroy_channel() where

hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and

Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt

handler to dereference freed memory, leading to a use-after-free or

NULL pointer dereference in mana_hwc_handle_resp().

mana_smc_teardown_hwc() signals the hardware to stop but does not

synchronize against IRQ handlers already executing on other CPUs. The

IRQ synchronization only happens in mana_hwc_destroy_cq() via

mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs

after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler()

can dereference freed caller_ctx (and rxq->msg_buf) in

mana_hwc_handle_resp().

Fix this by reordering teardown to reverse-of-creation order: destroy

the TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx. This

ensures all in-flight interrupt handlers complete before the memory they

access is freed.