{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.19.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: mana: Fix double destroy_workqueue on service rescan PCI path  While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path.  When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() destroys gc-\u003eservice_wq. If the subsequent mana_gd_resume() fails with -ETIMEDOUT or -EPROTO, the code falls through to mana_serv_rescan() which triggers pci_stop_and_remove_bus_device(). This invokes the PCI .remove callback (mana_gd_remove), which calls mana_gd_cleanup() a second time, attempting to destroy the already- freed workqueue. Fix this by NULL-checking gc-\u003eservice_wq in mana_gd_cleanup() and setting it to NULL after destruction.  Call stack of issue for reference: [Sat Feb 21 18:53:48 2026] Call Trace: [Sat Feb 21 18:53:48 2026]  \u003cTASK\u003e [Sat Feb 21 18:53:48 2026]  mana_gd_cleanup+0x33/0x70 [mana] [Sat Feb 21 18:53:48 2026]  mana_gd_remove+0x3a/0xc0 [mana] [Sat Feb 21 18:53:48 2026]  pci_device_remove+0x41/0xb0 [Sat Feb 21 18:53:48 2026]  device_remove+0x46/0x70 [Sat Feb 21 18:53:48 2026]  device_release_driver_internal+0x1e3/0x250 [Sat Feb 21 18:53:48 2026]  device_release_driver+0x12/0x20 [Sat Feb 21 18:53:48 2026]  pci_stop_bus_device+0x6a/0x90 [Sat Feb 21 18:53:48 2026]  pci_stop_and_remove_bus_device+0x13/0x30 [Sat Feb 21 18:53:48 2026]  mana_do_service+0x180/0x290 [mana] [Sat Feb 21 18:53:48 2026]  mana_serv_func+0x24/0x50 [mana] [Sat Feb 21 18:53:48 2026]  process_one_work+0x190/0x3d0 [Sat Feb 21 18:53:48 2026]  worker_thread+0x16e/0x2e0 [Sat Feb 21 18:53:48 2026]  kthread+0xf7/0x130 [Sat Feb 21 18:53:48 2026]  ? __pfx_worker_thread+0x10/0x10 [Sat Feb 21 18:53:48 2026]  ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026]  ret_from_fork+0x269/0x350 [Sat Feb 21 18:53:48 2026]  ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026]  ret_from_fork_asm+0x1a/0x30 [Sat Feb 21 18:53:48 2026]  \u003c/TASK\u003e",
  "id": "DEBIAN-CVE-2026-43276",
  "modified": "2026-09-14T16:47:30.375410450Z",
  "published": "2026-05-06T12:16:48.930Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-43276"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-43276"
  ]
}