The Linux kernel mana driver publishes an XDP program before allocating per‑queue buffers. If the buffer pre‑allocation fails, the error path skips the cleanup that would restore the previous program pointer. The stale pointer remains in apc->bpf_prog, and subsequent calls to bpf_prog_add() operate on freed memory, resulting in a use‑after‑free scenario that can corrupt kernel state and cause a crash or allow code execution with kernel privileges.

All Linux kernel releases containing the unpatched mana driver are affected. The exploit is triggered by the normal command to attach an XDP program (e.g., "ip link set dev ethX xdp obj …"). No specific kernel version range is listed, so any system with the mana driver prior to the patch is considered vulnerable.

The EPSS score is below 1%, the CVSS v3 score is 7.0, and the vulnerability is not listed in CISA KEV. The primary attack vector is a local privileged action that attaches an XDP program, which an attacker with root or equivalent access can perform. Successful exploitation can lead to denial of service or privilege escalation to kernel mode. While the probability of exploitation appears low, the impact of a kernel crash or code execution is significant.