In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In… (CVE-2026-64018)
In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.
AI Analysis
Technical Summary
CVE-2026-64018 describes a vulnerability in the Linux kernel's mana network driver where the rx_req_idx index, derived from DMA-coherent memory that can be modified by hardware in Confidential VMs (SEV-SNP/TDX), was not validated before use. This lack of bounds checking in mana_hwc_rx_event_handler() could lead to out-of-bounds access of the reqs[] array. The vulnerability has been fixed by introducing a bounds check on rx_req_idx prior to its use as an array index.
Potential Impact
The vulnerability allows out-of-bounds array access in kernel memory, which could lead to memory corruption or instability in affected systems. This is particularly relevant in environments using Confidential VMs where hardware can modify shared memory contents. No known exploits are reported in the wild at this time.
Mitigation Recommendations
A fix has been implemented in the Linux kernel source to add bounds checking on rx_req_idx in mana_hwc_rx_event_handler(). Users and administrators should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in this data; check the vendor or Linux kernel advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In… (CVE-2026-64018)
Description
In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-64018 describes a vulnerability in the Linux kernel's mana network driver where the rx_req_idx index, derived from DMA-coherent memory that can be modified by hardware in Confidential VMs (SEV-SNP/TDX), was not validated before use. This lack of bounds checking in mana_hwc_rx_event_handler() could lead to out-of-bounds access of the reqs[] array. The vulnerability has been fixed by introducing a bounds check on rx_req_idx prior to its use as an array index.
Potential Impact
The vulnerability allows out-of-bounds array access in kernel memory, which could lead to memory corruption or instability in affected systems. This is particularly relevant in environments using Confidential VMs where hardware can modify shared memory contents. No known exploits are reported in the wild at this time.
Mitigation Recommendations
A fix has been implemented in the Linux kernel source to add bounds checking on rx_req_idx in mana_hwc_rx_event_handler(). Users and administrators should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in this data; check the vendor or Linux kernel advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-r2vm-q278-6vpv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64018"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27aa2a4a8d598912d56d
Added to database: 07/19/2026, 19:38:18 UTC
Last enriched: 07/19/2026, 19:58:52 UTC
Last updated: 07/20/2026, 19:41:22 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.