VulnerabilityPublished 15 Aug 2026Updated 6 Nov 2026

CVE-2026-74265: Linux kernel · net: mana: initialize gdma queue id to INVALID_QUEUE_ID

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in c6662f3ad1c7c3549a1c39545651833220b0de89 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 18:11 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in c6662f3ad1c7c3549a1c39545651833220b0de89, a493cbb6b11acd4adc93397a4b12bd460d47620d, 5985474e1cb4034680fac2145497a94b0860be50 +4

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, < c6662f3ad1c7c3549a1c39545651833220b0de89	Fixed in c6662f3ad1c7c3549a1c39545651833220b0de89
LinuxLinux	Affected ≥ ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, < a493cbb6b11acd4adc93397a4b12bd460d47620d	Fixed in a493cbb6b11acd4adc93397a4b12bd460d47620d
LinuxLinux	Affected ≥ ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, < 5985474e1cb4034680fac2145497a94b0860be50	Fixed in 5985474e1cb4034680fac2145497a94b0860be50
LinuxLinux	Affected ≥ ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, < 150590d9ab0dbeb0087193058363819d4c82a00f	Fixed in 150590d9ab0dbeb0087193058363819d4c82a00f
LinuxLinux	Affected ≥ ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, < 372e7318af379eee29ab6e60848ce7d7db76c85a	Fixed in 372e7318af379eee29ab6e60848ce7d7db76c85a
LinuxLinux	Affected ≥ ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, < 62ce489acb428a936bdf243e7b92b3eb341447cf	Fixed in 62ce489acb428a936bdf243e7b92b3eb341447cf

AI-suggested

A fix is available and has been applied in the Linux kernel commits identified by hashes c6662f3ad1c7c3549a1c39545651833220b0de89 and others. Users should update to a fixed Linux kernel version containing these commits to remediate the issue.

Description

A vulnerability in the Linux kernel's net: mana component was fixed by initializing the gdma queue id to INVALID_QUEUE_ID after allocation. Previously, the queue id was left as 0 until assigned by firmware, which could cause cleanup routines to incorrectly nullify a real completion queue, leading to silent corruption.

Impact

This flaw could cause silent corruption of the completion queue table by nullifying an active completion queue entry during cleanup after a failed creation. This may lead to instability or malfunction in the network driver subsystem relying on the mana gdma queues. No direct exploit or active exploitation is known.

Summary

The Linux kernel's net: mana driver had a flaw where mana_gd_create_mana_wq_cq() left the gdma queue id as 0 after allocation (from kzalloc_obj()) until mana_create_wq_obj() assigned the firmware-returned id. If creation failed before assignment, cleanup called mana_gd_destroy_cq() with id 0, which nulled gc->cq_table[0], inadvertently breaking the real completion queue owning that slot. The fix was to initialize queue->id to INVALID_QUEUE_ID immediately after allocation, ensuring the existing guard (id >= max_num_cqs) prevents improper cleanup actions.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 18:11 UTC

Technical details

References

Community reviews

Related threats