CVE-2026-64034

net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

State: Published
Severity: 9.3 Critical
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic.

DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation.

Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().

Scores

CVSS	Score	Vector	Source
3.1	9.3 Critical	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Affected Products

Product	Versions
LinuxLinux	ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before a201c66edf2ebc6cfdc3813a889ba20fecebfae3Affected ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 70ad2dff8d052a85dfef15715b531f38a29108cfAffected ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 566f42fb67a7ebfed6650e407e5b72e6b3e83bf7Affected ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 6180a06bbc99fd9114b8db4be6c4d46e40f046efAffected ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 09ec063d87c2dd3fa6f3561361a017bd882e9f37Affected ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 3c4db56ccd13dd020fbf43afabaee74a40ec75e4Affected ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 35f0f0a2536a4d604b4dbad92c85c4a8fdebb870Affected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before a201c66edf2ebc6cfdc3813a889ba20fecebfae3Affected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 70ad2dff8d052a85dfef15715b531f38a29108cfAffected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 566f42fb67a7ebfed6650e407e5b72e6b3e83bf7Affected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 6180a06bbc99fd9114b8db4be6c4d46e40f046efAffected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 09ec063d87c2dd3fa6f3561361a017bd882e9f37Affected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 3c4db56ccd13dd020fbf43afabaee74a40ec75e4Affected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 35f0f0a2536a4d604b4dbad92c85c4a8fdebb870Affected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.