Critical 9.3Published Jul 19, 2026

CVE-2026-64018net: mana: validate rx_req_idx to prevent out-of-bounds array access

Updated under an hour ago (Oct 26, 2026, 4:23 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.

CVSS: 9.3 CRITICAL (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 5ddc715324badd7f2641bc177db1d027b402adae; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before ff1d5af207bcea857d45fe81505f1bc4b29eaef0; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 763a372d344fb12fae566d36ddb46e92454ad58c; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before fa627a5eaa83fc0261f44ef3769693b886ca6e27; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 355e9f2b2a7887ca38100127989af3e422ba71d0; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before b809d0409991b75a6cff846a5ac27c3062953f84	CNA record
linux linux_kernel linux:linux_kernel	from 5.13 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/5ddc715324badd7f2641bc177db1d027b402adae	patch
https://git.kernel.org/stable/c/ff1d5af207bcea857d45fe81505f1bc4b29eaef0	patch
https://git.kernel.org/stable/c/01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01	patch
https://git.kernel.org/stable/c/763a372d344fb12fae566d36ddb46e92454ad58c	patch
https://git.kernel.org/stable/c/fa627a5eaa83fc0261f44ef3769693b886ca6e27	patch
https://git.kernel.org/stable/c/355e9f2b2a7887ca38100127989af3e422ba71d0	patch
https://git.kernel.org/stable/c/b809d0409991b75a6cff846a5ac27c3062953f84	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.