CVE-2026-64018 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
net: mana: validate rx_req_idx to prevent out-of-bounds array access
In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[].
Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified in the Linux kernel's net: mana driver represents a critical out-of-bounds memory access flaw that specifically affects Confidential Virtual Machines utilizing SEV-SNP or TDX technologies. This issue stems from insufficient input validation within the mana_hwc_rx_event_handler() function where rx_req_idx values are extracted from sge->address fields located in DMA-coherent memory regions. The fundamental problem arises because in Confidential VM environments, the memory is shared unencrypted and hardware components can modify Work Queue Entry (WQE) contents at any time, creating a scenario where malicious or erroneous hardware modifications could lead to unpredictable behavior.
The technical flaw manifests when rx_req_idx values derived from the untrusted hardware source are directly used as array indices without proper bounds validation against the reqs[] array. This creates a classic buffer overflow condition where an attacker-controlled value can cause memory access outside the legitimate array boundaries, potentially leading to information disclosure, arbitrary code execution, or system instability. The vulnerability is particularly dangerous in Confidential VM environments because the hardware modifications are not properly isolated from the guest operating system, creating multiple attack vectors through which malicious actors could manipulate the WQE contents.
The operational impact of this vulnerability extends beyond simple memory corruption as it specifically targets the networking subsystem of virtualized environments where security isolation is paramount. In Confidential Computing scenarios, where data integrity and confidentiality must be maintained, this flaw undermines the fundamental security guarantees provided by SEV-SNP and TDX technologies. The absence of bounds checking creates a pathway for privilege escalation attacks that could allow malicious actors to gain unauthorized access to sensitive information or manipulate network communications. This vulnerability directly violates the principle of least privilege and can compromise the entire virtualization stack.
The mitigation strategy involves implementing proper bounds validation on rx_req_idx values before they are used to index into the reqs[] array within the mana_hwc_rx_event_handler() function. This approach aligns with established security practices that emphasize input validation as a primary defense mechanism against buffer overflow vulnerabilities. The fix must ensure that rx_req_idx values fall within the legitimate range of the reqs[] array dimensions, preventing out-of-bounds memory access patterns. This remediation addresses the underlying CWE-129 vulnerability category related to insufficient bounds checking and aligns with ATT&CK techniques focused on privilege escalation through memory corruption exploits. The solution represents a defensive programming approach that maintains system stability while preserving the intended functionality of the networking driver in Confidential VM environments.