CVE-2026-64018

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Access in Linux Kernel MANA Driver

Publication date: 2026-07-19

Last updated on: 2026-10-16

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-18

NVD

CVE-2026-64018

EUVD

EUVD-2026-45591

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.13 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where an out-of-bounds array access can occur in the mana_hwc_rx_event_handler() function. The issue arises because rx_req_idx, derived from hardware memory, lacks bounds checking before indexing the reqs[] array. This is particularly problematic in Confidential VMs where shared unencrypted memory allows hardware to modify data.

Detection Guidance

This vulnerability involves an out-of-bounds array access in the Linux kernel's mana driver. Detection requires checking if the system uses the affected kernel version with the mana driver enabled. Inspect kernel logs for related errors or monitor system behavior for unexpected crashes or memory corruption. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to cause memory corruption, leading to system crashes or potential privilege escalation. If exploited, it may enable unauthorized access to sensitive data or disrupt normal system operations.

Compliance Impact

This vulnerability involves an out-of-bounds array access in the Linux kernel's mana driver, which could lead to memory corruption or unauthorized memory access. While not directly tied to GDPR or HIPAA, such vulnerabilities may impact compliance by compromising data integrity and confidentiality in systems handling sensitive data. Unauthorized memory access could potentially expose protected health information or personal data, violating GDPR or HIPAA requirements for data security and access controls.

Mitigation Strategies

Apply the kernel patch that adds bounds checking for rx_req_idx in mana_hwc_rx_event_handler(). Update to a patched kernel version if available. Disable the mana driver if not in use. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-64018. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70