CVE-2026-64034
Received Received - Intake

Double-Fetch Vulnerability in Linux Kernel's mana Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic. DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation. Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64034
EUVD
EUVD-2026-45607

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Time-of-Check Time-of-Use (TOCTOU) vulnerability in the Linux kernel's mana network driver. It involves a double-fetch issue where a field from a DMA buffer is read twice without synchronization. The first read validates bounds, but a hardware component could modify the value between reads, bypassing security checks. The fix involves reading the value once using READ_ONCE() and passing it as a parameter.

Detection Guidance

This vulnerability is specific to the Linux kernel's mana driver and involves a double-fetch issue in DMA-coherent memory. Detection requires checking kernel logs for mana driver errors or unusual network events. Use commands like dmesg | grep mana or journalctl -k | grep mana to inspect kernel logs for related errors.

Impact Analysis

An attacker with access to manipulate DMA memory could exploit this to bypass bounds checks, potentially leading to memory corruption, denial of service, or unauthorized access. Systems using the affected Linux kernel's mana driver are at risk if DMA memory is exposed to untrusted entities.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-level kernel memory handling issue. However, if exploited, it could lead to unauthorized memory access or data corruption, which may indirectly impact data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version that includes the fix for CVE-2026-64034. If immediate patching is not possible, disable the mana driver module (mana) if not in use to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64034. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart