CVE-2026-63973
net: mana: Add NULL guards in teardown path to prevent panic on attach failure
Description
In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc->tx_qp and apc->rxqs. Multiple teardown paths such as mana_remove(), mana_change_mtu() recovery, and internal error handling in mana_alloc_queues() can subsequently call into functions that dereference these pointers without NULL checks: - mana_chn_setxdp() dereferences apc->rxqs[0], causing a NULL pointer dereference panic (CR2: 0000000000000000 at mana_chn_setxdp+0x26). - mana_destroy_vport() iterates apc->rxqs without a NULL check. - mana_fence_rqs() iterates apc->rxqs without a NULL check. - mana_dealloc_queues() iterates apc->tx_qp without a NULL check. Add NULL guards for apc->rxqs in mana_fence_rqs(), mana_destroy_vport(), and before the mana_chn_setxdp() call. Add a NULL guard for apc->tx_qp in mana_dealloc_queues() to skip TX queue draining when TX queues were never allocated or already freed.
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 30, 2026, 2:51 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update the Linux kernel to the latest version.
- Ensure NULL guards are present in the teardown path.
- Verify allocation and freeing logic for queues.
- Test the attachment and teardown sequences.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63973.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63973 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63973
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63973 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63973 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f', 'lessThan': 'da7e4a1aaf397af6a094f640c92d6bc7564c10db', 'versionType': 'git'}, {'status': 'affected', 'version': 'ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f', 'lessThan': '95e414f8324385771bdfd6d497a01d5593813ccb', 'versionType': 'git'}, {'status': 'affected', 'version': 'ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f', 'lessThan': '26a96fa81496afe7d162d172ccdc8cb9dbc685d2', 'versionType': 'git'}, {'status': 'affected', 'version': 'ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f', 'lessThan': 'da87896f34e0a51489811d1a684e2953099ca98f', 'versionType': 'git'}, {'status': 'affected', 'version': 'ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f', 'lessThan': '0a9c520fdcb1cb2e79c163c12d359b5e1ee40007', 'versionType': 'git'}, {'status': 'affected', 'version': 'ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f', 'lessThan': '17bfe0a8c014ee1d542ad352cd6a0a505361664a', 'versionType': 'git'}], 'programFiles': ['drivers/net/ethernet/microsoft/mana/mana_en.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.13'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.13', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/ethernet/microsoft/mana/mana_en.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc->tx_qp and apc->rxqs. Multiple teardown paths such as mana_remove(), mana_change_mtu() recovery, and internal error handling in mana_alloc_queues() can subsequently call into functions that dereference these pointers without NULL checks: - mana_chn_setxdp() dereferences apc->rxqs[0], causing a NULL pointer dereference panic (CR2: 0000000000000000 at mana_chn_setxdp+0x26). - mana_destroy_vport() iterates apc->rxqs without a NULL check. - mana_fence_rqs() iterates apc->rxqs without a NULL check. - mana_dealloc_queues() iterates apc->tx_qp without a NULL check. Add NULL guards for apc->rxqs in mana_fence_rqs(), mana_destroy_vport(), and before the mana_chn_setxdp() call. Add a NULL guard for apc->tx_qp in mana_dealloc_queues() to skip TX queue draining when TX queues were never allocated or already freed. Added Reference https://git.kernel.org/stable/c/0a9c520fdcb1cb2e79c163c12d359b5e1ee40007 Added Reference https://git.kernel.org/stable/c/17bfe0a8c014ee1d542ad352cd6a0a505361664a Added Reference https://git.kernel.org/stable/c/26a96fa81496afe7d162d172ccdc8cb9dbc685d2 Added Reference https://git.kernel.org/stable/c/95e414f8324385771bdfd6d497a01d5593813ccb Added Reference https://git.kernel.org/stable/c/da7e4a1aaf397af6a094f640c92d6bc7564c10db Added Reference https://git.kernel.org/stable/c/da87896f34e0a51489811d1a684e2953099ca98f