In the Linux kernel net/mana subsystem, a use‑after‑free flaw is triggered when auxiliary_device_add() fails. The error path in add_adev() calls auxiliary_device_uninit(), which invokes the release callback that frees the containing struct mana_adev. After this call the code falls through to init_fail and accesses the freed object's id field, creating a use‑after‑free situation that can corrupt kernel memory and allow an attacker to execute arbitrary code with elevated privileges.

The vulnerability impacts all Linux kernel versions that include the net/mana code before the countermeasure commit. No specific kernel releases are listed; any unpatched kernel containing this code path is considered vulnerable.

The CVSS score is 7.8 and the EPSS score is < 1%, indicating moderate severity with a very low probability of exploitation. The flaw is not listed in CISA KEV. Based on the nature of the kernel use‑after‑free, the attack vector is presumed to be local, requiring an attacker to trigger auxiliary_device_add() to fail or otherwise invoke the error path. Successful exploitation would grant the attacker kernel privileges, effectively allowing privilege escalation to root.