CVE-2026-64034
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel's MANA driver, a TOCTOU (time-of-check time-of-use) vulnerability was found due to a double-fetch of the hwc_msg_id field from a DMA buffer. The first read is used for bounds checking, and the second for further processing, allowing a malicious device to alter the value between reads and bypass the validation.
Risk Assessment
An attacker could exploit this flaw to compromise data integrity in DMA memory, potentially leading to privilege escalation or information disclosure in confidential VM environments (SEV-SNP/TDX).
Recommendation
Apply the Linux kernel patch immediately, which reads hwc_msg_id once using READ_ONCE() and passes the validated value as a parameter to mana_hwc_handle_resp().
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic. DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation. Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().