Critical severity9.3NVD Advisory· Published Jul 19, 2026· Updated Jul 30, 2026
CVE-2026-64018
CVE-2026-64018
Description
In the Linux kernel, the following vulnerability has been resolved:
net: mana: validate rx_req_idx to prevent out-of-bounds array access
In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[].
Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.
Affected products
50- osv-coords49 versionspkg:linux/kernelpkg:rpm/almalinux/bpftoolpkg:rpm/almalinux/kernelpkg:rpm/almalinux/kernel-abi-stablelistspkg:rpm/almalinux/kernel-corepkg:rpm/almalinux/kernel-cross-headerspkg:rpm/almalinux/kernel-debugpkg:rpm/almalinux/kernel-debug-corepkg:rpm/almalinux/kernel-debug-develpkg:rpm/almalinux/kernel-debug-modulespkg:rpm/almalinux/kernel-debug-modules-extrapkg:rpm/almalinux/kernel-develpkg:rpm/almalinux/kernel-docpkg:rpm/almalinux/kernel-headerspkg:rpm/almalinux/kernel-modulespkg:rpm/almalinux/kernel-modules-extrapkg:rpm/almalinux/kernel-rtpkg:rpm/almalinux/kernel-rt-corepkg:rpm/almalinux/kernel-rt-debugpkg:rpm/almalinux/kernel-rt-debug-corepkg:rpm/almalinux/kernel-rt-debug-develpkg:rpm/almalinux/kernel-rt-debug-modulespkg:rpm/almalinux/kernel-rt-debug-modules-extrapkg:rpm/almalinux/kernel-rt-develpkg:rpm/almalinux/kernel-rt-modulespkg:rpm/almalinux/kernel-rt-modules-extrapkg:rpm/almalinux/kernel-toolspkg:rpm/almalinux/kernel-tools-libspkg:rpm/almalinux/kernel-tools-libs-develpkg:rpm/almalinux/kernel-zfcpdumppkg:rpm/almalinux/kernel-zfcpdump-corepkg:rpm/almalinux/kernel-zfcpdump-develpkg:rpm/almalinux/kernel-zfcpdump-modulespkg:rpm/almalinux/kernel-zfcpdump-modules-extrapkg:rpm/almalinux/perfpkg:rpm/almalinux/python3-perfpkg:rpm/opensuse/dtb-aarch64&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-64kb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-azure&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-default&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-default-base&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-docs&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-kvmsmall&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-obs-build&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-obs-qa&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-rt&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-syms&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-zfcpdump&distro=openSUSE%20Leap%2016.0
>= 5.13.0, < 5.15.209+ 48 more
- (no CPE)range: >= 5.13.0, < 5.15.209
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.rt7.500.el8_10
- (no CPE)range: < 4.18.0-553.159.1.rt7.500.el8_10
- (no CPE)range: < 4.18.0-553.159.1.rt7.500.el8_10
- (no CPE)range: < 4.18.0-553.159.1.rt7.500.el8_10
- (no CPE)range: < 4.18.0-553.159.1.rt7.500.el8_10
- (no CPE)range: < 4.18.0-553.159.1.rt7.500.el8_10
- (no CPE)range: < 4.18.0-553.159.1.rt7.500.el8_10
- (no CPE)range: < 4.18.0-553.159.1.rt7.500.el8_10
- (no CPE)range: < 4.18.0-553.159.1.rt7.500.el8_10
- (no CPE)range: < 4.18.0-553.159.1.rt7.500.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 4.18.0-553.159.1.el8_10
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1.160000.2.19
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
Patches
Vulnerability mechanics
References
7- git.kernel.org/stable/c/01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01nvd
- git.kernel.org/stable/c/355e9f2b2a7887ca38100127989af3e422ba71d0nvd
- git.kernel.org/stable/c/5ddc715324badd7f2641bc177db1d027b402adaenvd
- git.kernel.org/stable/c/763a372d344fb12fae566d36ddb46e92454ad58cnvd
- git.kernel.org/stable/c/b809d0409991b75a6cff846a5ac27c3062953f84nvd
- git.kernel.org/stable/c/fa627a5eaa83fc0261f44ef3769693b886ca6e27nvd
- git.kernel.org/stable/c/ff1d5af207bcea857d45fe81505f1bc4b29eaef0nvd
News mentions
0No linked articles in our index yet.