Critical 9.3Published Jul 19, 2026

CVE-2026-64034net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

Updated under an hour ago (Oct 26, 2026, 12:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic. DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation. Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().

CVSS: 9.3 CRITICAL (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-367
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before a201c66edf2ebc6cfdc3813a889ba20fecebfae3; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 70ad2dff8d052a85dfef15715b531f38a29108cf; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 566f42fb67a7ebfed6650e407e5b72e6b3e83bf7; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 6180a06bbc99fd9114b8db4be6c4d46e40f046ef; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 09ec063d87c2dd3fa6f3561361a017bd882e9f37; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 3c4db56ccd13dd020fbf43afabaee74a40ec75e4; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f before 35f0f0a2536a4d604b4dbad92c85c4a8fdebb870	CNA record
linux linux_kernel linux:linux_kernel	from 5.13 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/a201c66edf2ebc6cfdc3813a889ba20fecebfae3	patch
https://git.kernel.org/stable/c/70ad2dff8d052a85dfef15715b531f38a29108cf	patch
https://git.kernel.org/stable/c/566f42fb67a7ebfed6650e407e5b72e6b3e83bf7	patch
https://git.kernel.org/stable/c/6180a06bbc99fd9114b8db4be6c4d46e40f046ef	patch
https://git.kernel.org/stable/c/09ec063d87c2dd3fa6f3561361a017bd882e9f37	patch
https://git.kernel.org/stable/c/3c4db56ccd13dd020fbf43afabaee74a40ec75e4	patch
https://git.kernel.org/stable/c/35f0f0a2536a4d604b4dbad92c85c4a8fdebb870	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.