CVE-2026-74265net: mana: initialize gdma queue id to INVALID_QUEUE_ID
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: mana: initialize gdma queue id to INVALID_QUEUE_ID mana_gd_create_mana_wq_cq() leaves queue->id as 0 (from kzalloc_obj()) until mana_create_wq_obj() assigns the firmware-returned id. If creation fails before that, cleanup calls mana_gd_destroy_cq() with id 0, NULLing gc->cq_table[0] and silently breaking whichever real CQ owns that slot. Initialize queue->id to INVALID_QUEUE_ID right after allocation, matching mana_gd_create_eq(). The existing (id >= max_num_cqs) guard then short-circuits cleanly.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 372e7318af379eee29ab6e60848ce7d7db76c85a; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before c6662f3ad1c7c3549a1c39545651833220b0de89; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 8e52a247d9aa979d43eb9ff1e445b9b3bf229d4d; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before a493cbb6b11acd4adc93397a4b12bd460d47620d; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 62ce489acb428a936bdf243e7b92b3eb341447cf; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 150590d9ab0dbeb0087193058363819d4c82a00f; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 5985474e1cb4034680fac2145497a94b0860be50 | CNA record |
References
- https://git.kernel.org/stable/c/372e7318af379eee29ab6e60848ce7d7db76c85a
- https://git.kernel.org/stable/c/c6662f3ad1c7c3549a1c39545651833220b0de89
- https://git.kernel.org/stable/c/8e52a247d9aa979d43eb9ff1e445b9b3bf229d4d
- https://git.kernel.org/stable/c/a493cbb6b11acd4adc93397a4b12bd460d47620d
- https://git.kernel.org/stable/c/62ce489acb428a936bdf243e7b92b3eb341447cf
- https://git.kernel.org/stable/c/150590d9ab0dbeb0087193058363819d4c82a00f
- https://git.kernel.org/stable/c/5985474e1cb4034680fac2145497a94b0860be50
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.