CVE-2026-64034 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic.
DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation.
Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability represents a classic time-of-check to time-of-use flaw that specifically targets the Linux kernel's network driver implementation for Microsoft's Network Adapter (MANA) hardware. The issue manifests in the mana_hwc_rx_event_handler function where the hwc_msg_id field is extracted from DMA-coherent memory and subjected to bounds validation before being passed to mana_hwc_handle_resp for further processing. The fundamental problem arises from the double-fetch pattern where the same field is read twice from the same memory location, creating a window of opportunity for malicious actors to manipulate the data between validation and usage.
The technical exploitation of this vulnerability leverages the characteristics of DMA-coherent memory mapping in x86 architectures, which operates without cache coherence and maintains shared, unencrypted access patterns in confidential virtual machines such as those utilizing SEV-SNP or TDX technologies. This memory access pattern means that each memory read operation directly accesses host-visible physical memory rather than cached copies, eliminating the typical protection mechanisms that might prevent such race conditions. The hardware can modify the value of hwc_msg_id between the initial bounds check and subsequent usage, effectively bypassing all validation controls and allowing unauthorized memory access patterns.
From a cybersecurity perspective, this vulnerability directly maps to CWE-367 Time-of-Check to Time-of-Use (TOCTOU) Error, which is classified as a critical weakness in software security practices. The attack surface extends beyond traditional privilege escalation scenarios into confidential computing environments where the integrity of memory operations is paramount. Network drivers operating in virtualized environments with hardware-assisted security features like SEV-SNP and TDX create particularly dangerous conditions for such vulnerabilities since they involve multiple layers of memory management and access control that can be exploited to bypass security boundaries.
The operational impact of this vulnerability could enable attackers to perform unauthorized memory access operations, potentially leading to privilege escalation within the kernel space or data corruption in network processing pipelines. In Confidential VM environments, this weakness undermines the core security guarantees provided by hardware-based memory encryption and isolation mechanisms. The vulnerability affects systems running Linux kernels with MANA network driver support, particularly those utilizing virtualization technologies with enhanced security features.
The fix implemented addresses the root cause by employing READ_ONCE() macro to ensure atomic reading of the hwc_msg_id field into a stack-local variable within the initial validation function. This approach eliminates the race condition by ensuring that the validated value is preserved in a local context before being passed as a parameter to the subsequent processing function. The solution aligns with established kernel security practices for handling DMA memory operations and follows the principle of minimizing shared state access patterns that could introduce timing vulnerabilities.
This remediation pattern demonstrates the importance of defensive programming techniques in kernel space development, particularly when dealing with hardware interfaces that may have external modification capabilities. The fix prevents potential exploitation through the use of proper memory ordering guarantees and eliminates the window of vulnerability created by the double-fetch pattern. Security teams should prioritize this patch deployment across systems utilizing MANA network adapters, especially in environments where confidential computing protections are actively employed, as it addresses a critical weakness that could compromise both system integrity and data confidentiality in virtualized deployments.