CVE-2026-64034

Analyzed Analyzed - Analysis Complete

Double-Fetch Vulnerability in Linux Kernel's mana Driver

Publication date: 2026-07-19

Last updated on: 2026-10-16

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic. DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation. Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-18

NVD

CVE-2026-64034

EUVD

EUVD-2026-45607

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.13 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This is a Time-of-Check Time-of-Use (TOCTOU) vulnerability in the Linux kernel's mana network driver. It involves a double-fetch issue where a field from a DMA buffer is read twice without synchronization. The first read validates bounds, but a hardware component could modify the value between reads, bypassing security checks. The fix involves reading the value once using READ_ONCE() and passing it as a parameter.

Detection Guidance

This vulnerability is specific to the Linux kernel's mana driver and involves a double-fetch issue in DMA-coherent memory. Detection requires checking kernel logs for mana driver errors or unusual network events. Use commands like dmesg | grep mana or journalctl -k | grep mana to inspect kernel logs for related errors.

Impact Analysis

An attacker with access to manipulate DMA memory could exploit this to bypass bounds checks, potentially leading to memory corruption, denial of service, or unauthorized access. Systems using the affected Linux kernel's mana driver are at risk if DMA memory is exposed to untrusted entities.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-level kernel memory handling issue. However, if exploited, it could lead to unauthorized memory access or data corruption, which may indirectly impact data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version that includes the fix for CVE-2026-64034. If immediate patching is not possible, disable the mana driver module (mana) if not in use to reduce exposure.

Hi! I’m here to help you understand CVE-2026-64034. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70