CVE-2026-64018
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In the Linux kernel's MANA network driver, the rx_req_idx is not validated before being used to index the reqs[] array. In confidential VMs (SEV-SNP/TDX), DMA memory can be modified by hardware, allowing out-of-bounds array access.
Risk Assessment
An attacker could exploit this vulnerability to read or write beyond allocated memory, potentially leading to system integrity compromise, data leakage, or kernel crash.
Recommendation
Apply the Linux kernel patch that adds bounds checking for rx_req_idx in mana_hwc_rx_event_handler(). Update to a kernel version containing this fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.