In the Linux kernel, the mana driver’s queue creation routine incorrectly leaves the queue identifier uninitialized until firmware assigns it. If queue creation fails before assignment, the cleanup routine mistakenly clears the global queue table entry at index zero, which may be a valid real queue. This corruption can destabilize the kernel and lead to a denial of service, but it does not directly enable arbitrary code execution.

All Linux kernels that include the mana device driver in the net subsystem and have not yet applied the patch that initializes queue->id to the invalid sentinel. The affected kernel code path is the mana_gd_create_mana_wq_cq function and its cleanup logic.

The CVSS score is 5.5, the EPSS score is < 1%, and the vulnerability is not flagged in the CISA KEV catalog. Exploitation would require privileged interaction with the mana driver to trigger a creation failure, after which the faulty cleanup could corrupt kernel state. The resulting denial of service risk is moderate, as it requires local kernel access or a privilege escalation vectored through the mana driver.