In the Linux kernel, the mana driver can be removed twice when a failed power‑management resume does not automatically unbind the driver. The second invocation of the removal routine dereferences a NULL pointer because the device reference is not checked, which causes a kernel panic. The flaw does not grant the attacker additional privileges and it only affects the system while it is running.

All Linux kernel builds that include the mana driver before the patch are affected. The vulnerability remains present across distributions until the kernel tree incorporates the guarded removal logic demonstrated in the cited commit references. Distribution packs that have not yet applied the patch should assume the flaw is present and verify against the commit identifiers listed.

The CVSS score is 5.5, indicating medium severity, and the EPSS score is <1%, meaning the likelihood of exploitation is very low. The vulnerability is not listed in CISA KEV. The attack path requires an action that causes the mana driver removal routine to be invoked twice when a power‑management resume fails. Based on the description, it is inferred that the attacker would need local or elevated privileges to force a resume failure or manipulate the device state. The resulting kernel panic causes a denial of service that requires a reboot and the crash is observable only while the system is running.