CVE-2026-97955 net: mana: restore the XDP program pointer when pre-allocation fails
A use-after-free in the Linux kernel mana driver allows local attackers with high privileges to execute arbitrary code or escalate privileges when XDP buffer allocation fails.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97955?
CVE-2026-97955 is an use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: mana: restore the XDP program pointer when pre-allocation fails
mana_xdp_set() publishes the new program into apc->bpf_prog before it allocates anything, because mana_pre_alloc_rxbufs() sizes the buffers from it via mana_get_rxbuf_cfg(). When that allocation fails the function returns the error directly, skipping the err_dealloc_rxbuffs label which is the only place that restores the previous pointer.
The attach is reported as failed, so the BPF core drops the reference it held for the caller and the program can be freed, while apc->bpf_prog still points at it. The next consumer of mana_xdp_get() - typically mana_chn_setxdp() from mana_alloc_queues() on the following ifup, or after a TX timeout reset - then calls bpf_prog_add() on freed memory.
This is reachable from an ordinary "ip link set dev ethX xdp obj ..." whenever the per-queue RX buffer pre-allocation cannot be satisfied.
Restore the previous program on that error path.
Which versions are affected by CVE-2026-97955?
How do I fix CVE-2026-97955?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-97955 being exploited?
There is no known exploitation of CVE-2026-97955 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-97955, DEBIAN-CVE-2026-97955, GHSA-3q2p-qw3j-4h22, UBUNTU-CVE-2026-97955.