CVE-2026-64018
Received Received - Intake

Out-of-Bounds Access in Linux Kernel MANA Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64018
EUVD
EUVD-2026-45591

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where an out-of-bounds array access can occur in the mana_hwc_rx_event_handler() function. The issue arises because rx_req_idx, derived from hardware memory, lacks bounds checking before indexing the reqs[] array. This is particularly problematic in Confidential VMs where shared unencrypted memory allows hardware to modify data.

Detection Guidance

This vulnerability involves an out-of-bounds array access in the Linux kernel's mana driver. Detection requires checking if the system uses the affected kernel version with the mana driver enabled. Inspect kernel logs for related errors or monitor system behavior for unexpected crashes or memory corruption. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to cause memory corruption, leading to system crashes or potential privilege escalation. If exploited, it may enable unauthorized access to sensitive data or disrupt normal system operations.

Compliance Impact

This vulnerability involves an out-of-bounds array access in the Linux kernel's mana driver, which could lead to memory corruption or unauthorized memory access. While not directly tied to GDPR or HIPAA, such vulnerabilities may impact compliance by compromising data integrity and confidentiality in systems handling sensitive data. Unauthorized memory access could potentially expose protected health information or personal data, violating GDPR or HIPAA requirements for data security and access controls.

Mitigation Strategies

Apply the kernel patch that adds bounds checking for rx_req_idx in mana_hwc_rx_event_handler(). Update to a patched kernel version if available. Disable the mana driver if not in use. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64018. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart