Answer in brief
CVE-2026-53297 records a Medium severity (CVSS 5.5) vulnerability in net: mana: Guard mana_remove against double invocation. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=635096a86edb067d55a1e04b4a918f5c6dac0c51 <793bf1f4e469c51d0e39199823da5e1de85a2741 || >=635096a86edb067d55a1e04b4a918f5c6dac0c51 <8ee85b75a72216c857c39457f6595709c4c9f856 || >=635096a86edb067d55a1e04b4a918f5c6dac0c51 <a1ddfd2c0b7a48e5239fadd2a24cc4bc2cda90e6 || >=635096a86edb067d55a1e04b4a918f5c6dac0c51 <bbe5c3c570645a4ceb120979d3ee203a1583d775 || >=635096a86edb067d55a1e04b4a918f5c6dac0c51 <50271d7ec95144d26808025b508f463780517d3c | 793bf1f4e469c51d0e39199823da5e1de85a2741, 8ee85b75a72216c857c39457f6595709c4c9f856, a1ddfd2c0b7a48e5239fadd2a24cc4bc2cda90e6, bbe5c3c570645a4ceb120979d3ee203a1583d775, 50271d7ec95144d26808025b508f463780517d3c |
| Linux/Linuxgeneric | 5.16 | Not reported |
Published upstream
Jun 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 26, 2026
In the Linux kernel, the following vulnerability has been resolved: net: mana: Guard mana_remove against double invocation If PM resume fails (e.g., mana_attach() returns an error), mana_probe() calls mana_remove(), which tears down the device and sets gd->gdma_context = NULL and gd->driver_data = NULL. However, a failed resume callback does not automatically unbind the driver. When the device is eventually unbound, mana_remove() is invoked a second time. Without a NULL check, it dereferences gc->dev with gc == NULL, causing a kernel panic. Add an early return if gdma_context or driver_data is NULL so the second invocation is harmless. Move the dev = gc->dev assignment after the guard so it cannot dereference NULL.
Quoted source text, attributed separately from HOL analysis.