The Linux kernel vulnerability CVE-2026-53297 affects the MANA driver. If the power management resume callback fails (e.g., mana_attach() returns an error), mana_probe() calls mana_remove(), which tears down the device and sets gd->gdma_context and gd->driver_data to NULL. However, the driver is not automatically unbound after a failed resume, so when the device is eventually unbound, mana_remove() is called again. Without NULL checks, this second call dereferences gc->dev where gc is NULL, causing a kernel panic. The fix adds early returns if gdma_context or driver_data are NULL and reorders assignments to avoid dereferencing NULL pointers.

This vulnerability can cause a denial of service by triggering a kernel panic when the MANA driver is unloaded after a failed power management resume. There is no impact on confidentiality or integrity. The CVSS score is 5.5 (medium severity) reflecting local attack vector, low complexity, low privileges required, no user interaction, and impact limited to availability.

A patch is available and should be applied. The vendor advisory from Ubuntu confirms that the issue is fixed in Linux kernel versions 7.0.0-28.28 and later for various Ubuntu 26.04 LTS kernel packages. Users should update their systems and reboot to apply the fix. No additional mitigation is required beyond applying the official kernel updates.