CVE-2026-64018: net: mana: validate rx_req_idx to prevent out-of-bounds array access
In the Linux kernel, the following vulnerability has been resolved:
net: mana: validate rxreqidx to prevent out-of-bounds array access
In manahwcrxeventhandler(), rxreqidx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rxreqidx, which can lead to an out-of-bounds access into reqs[].
Add bounds check on rxreqidx in manahwcrxeventhandler() before using it to index the reqs[] array.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add a bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64018?
CVE-2026-64018 has a risk score of 43, indicating a potentially serious vulnerability.
What type of vulnerability is CVE-2026-64018?
CVE-2026-64018 is an out-of-bounds array access vulnerability in the Linux kernel's net subsystem.
How do I fix CVE-2026-64018?
To fix CVE-2026-64018, ensure you are using an updated version of the Linux kernel where this vulnerability has been addressed.
What systems are affected by CVE-2026-64018?
CVE-2026-64018 affects systems running specific configurations of the Linux kernel with DMA-coherent memory.
Can CVE-2026-64018 lead to data breaches?
Yes, CVE-2026-64018 can potentially lead to unauthorized access or corruption of data due to out-of-bounds access.