CVE Intelligence
Analysis AI-assisted

CVE-2026-64018: Linux kernel mana network driver: out-of-bounds array access via unvalidated rx_req_idx

CVE-2026-64018 affects the mana network driver in the Linux kernel. The receive event handler used an index read from DMA-coherent memory that hardware can modify, without a bounds check, which can lead to out-of-bounds access into the reqs array. The record gives a critical score of 9.3 and lists fixes in several stable branches.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-64018 is a fix in the mana network driver of the Linux kernel. In mana_hwc_rx_event_handler(), the request index is read from a DMA-coherent buffer. The record states that in Confidential VMs (SEV-SNP or TDX) this memory is shared unencrypted and the hardware may change its contents at any time, and that no bounds check existed before the index was used to access the reqs[] array.

Impact

  • The record describes a possible out-of-bounds access into reqs[] caused by an unvalidated index.
  • The CNA rates the issue critical, with a score of 9.3, and its vector lists high confidentiality, integrity and availability impact.
  • The SSVC technical impact is recorded as total.

Affected products and versions

  • The record lists the Linux kernel under two product entries. The first gives a commit-based range that cannot be mapped to version numbers from the record alone.
  • The second entry gives these ranges, using the endpoints from the record:
  • From 5.13 up to before 5.15.209
  • From 5.16 up to before 6.1.175
  • From 6.2 up to before 6.6.142
  • From 6.7 up to before 6.12.92
  • From 6.13 up to before 6.18.34
  • From 6.19 up to before 7.0.11
  • Release candidates 7.1-rc1, 7.1-rc2, 7.1-rc3 and 7.1-rc4 are listed as affected, with no fixed version given in the record.

Exploitation status

  • The KEV catalog flag is false. No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.00142 and the SSVC exploitation value is none, with automatable set to no.

Remediation and mitigation

  • Update to a stable kernel release that includes the fix for your branch, as listed in the vendor and stable references.
  • For branches or release candidates without a listed fix, check upstream for later releases, because the record does not state them.
  • The vector indicates a local attack vector, so limiting local access on affected hosts, especially Confidential VM hosts, reduces exposure.

Detection guidance

  • Inventory kernel versions and whether the mana driver is in use.
  • Review kernel logs on affected hosts for unexpected faults or memory errors related to the mana driver. This is high-level guidance only.

Limitations of the available information

  • The record does not describe the exact trigger conditions, exploitability in practice or observed impact.
  • The commit-based range cannot be converted to version numbers from the record.
  • The record does not state whether release candidates 7.1-rc1 to 7.1-rc4 have been fixed in later releases.
  • The CWE is listed as CWE-129 without a name in the record.

Frequently asked questions

Is CVE-2026-64018 being actively exploited?

The KEV flag is false and no confirmed exploitation appears in the sources consulted. EPSS is 0.00142 and SSVC exploitation is recorded as none.

Which kernel versions are affected?

The record lists ranges from 5.13 up to before 5.15.209, from 5.16 up to before 6.1.175, from 6.2 up to before 6.6.142, from 6.7 up to before 6.12.92, from 6.13 up to before 6.18.34 and from 6.19 up to before 7.0.11. Release candidates 7.1-rc1 to 7.1-rc4 are also listed.

What should administrators do?

Apply the stable kernel update that contains the fix for your branch, and check upstream for updates where the record gives no fixed version.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.