The Linux kernel's mana network driver contained a TOCTOU vulnerability (CVE-2026-64034) where the hwc_msg_id field was read twice from DMA-coherent memory in mana_hwc_rx_event_handler() and mana_hwc_handle_resp(). Because DMA-coherent memory is uncacheable and shared, hardware could modify hwc_msg_id between the initial bounds check and later use, bypassing validation. The vulnerability was resolved by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable and passing the validated value to subsequent handlers, preventing the double-fetch race condition.

This vulnerability could allow an attacker with hardware-level access to modify the hwc_msg_id value between validation and use, potentially bypassing bounds checks. This could lead to undefined behavior or security issues in the mana network driver. However, exploitation requires hardware capability to modify DMA memory during execution, limiting practical impact. No known exploits are reported.

A fix has been implemented in the Linux kernel to address this vulnerability by changing the code to read hwc_msg_id once atomically. Users should update to a Linux kernel version that includes this fix. Since no patch links or specific versions are provided, check the official Linux kernel advisories or repositories for the fixed version. No additional mitigations are indicated.