CVE-2026-64018: net: mana: validate rx_req_idx to prevent out-of-bounds array access

Severity: critical (CVSS 9.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-19 · updated 2026-10-19
Weakness: CWE-129

Description

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.

Affected products

Linux kernel: from 5.13 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11 — fixed in 5.15.209, 6.1.175, 6.12.92, 6.18.34, 6.6.142, 7.0.11

How to fix

Upgrade to a fixed version: Linux kernel 5.15.209, 6.1.175, 6.12.92, 6.18.34. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-64018 or the next vulnerability affects your stack