CVE-2026-64034: Linux kernel mana driver TOCTOU double-fetch of DMA buffer value

Overview

The record describes a time-of-check to time-of-use (TOCTOU) double-fetch in the mana network driver of the Linux kernel. The value of hwc_msg_id is read from DMA-coherent memory and bounds-checked, then read again from the same buffer, so the checked value and the used value can differ. The associated weakness is CWE-367 (TOCTOU Race Condition). See the NVD entry and the CVE Record.

Impact

• The record lists a CVSS score of 9.3 from several providers, including the Linux CNA and GitHub, and a critical severity.
• The record's SSVC data gives a technical impact of total.
• The description states that a hardware-side modification between the check and the use could bypass the bounds validation. The exact consequence is not detailed in the record.

Affected products and versions

The record lists two product entries. The entry 'Linux Linux' includes version 5.13 and commit-based ranges that are not expressed as version numbers. The entry 'Linux Linux Kernel' lists these ranges:

• Series 7.1-rc1, 7.1-rc2, 7.1-rc3 and 7.1-rc4 are listed individually as affected.
• From 5.13 up to before 5.15.209.
• From 5.16 up to before 6.1.175.
• From 6.2 up to before 6.6.142.
• From 6.7 up to before 6.12.92.
• From 6.13 up to before 6.18.34.
• From 6.19 up to before 7.0.11.

These ranges are reproduced from the record and should be checked against the vendor or distribution advisory for your kernel build.

Exploitation status

The CISA KEV field in the record is false, and the SSVC exploitation value is none. The record's EPSS probability is 0.00115 with a percentile of 0.01467. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

• Apply the kernel update from your distribution or the Linux stable branch that contains the upstream fix. The record links these stable commits:
• Stable commit 09ec063d87c2dd3fa6f3561361a017bd882e9f37
• Stable commit 35f0f0a2536a4d604b4dbad92c85c4a8fdebb870
• Stable commit 3c4db56ccd13dd020fbf43afabaee74a40ec75e4
• Stable commit 566f42fb67a7ebfed6650e407e5b72e6b3e83bf7
• Stable commit 6180a06bbc99fd9114b8db4be6c4d46e40f046ef
• Stable commit 70ad2dff8d052a85dfef15715b531f38a29108cf
• Stable commit a201c66edf2ebc6cfdc3813a889ba20fecebfae3
• Prioritize systems that run the mana driver, especially Confidential VMs, since the description ties the issue to shared, unencrypted DMA memory there.
• The record does not describe a workaround. If patching is delayed, the available mitigation guidance is unknown.

Detection guidance

• Inventory kernel versions on hosts that use the mana driver and compare them with the ranges listed above.
• Check vendor changelogs for the upstream fix, since distributions may backport it without changing the upstream version string.
• Review the GitHub advisory for any additional tracking information.

Limitations of the available information

• The record does not describe the exact effect of a successful race beyond the bounds-check bypass.
• The commit-based ranges in the 'Linux Linux' entry are not expressed as version numbers and cannot be mapped to versions here.
• Distribution backports and vendor-specific status are not included in the record.
• No proof-of-concept or exploitation details are provided, and this analysis does not add any.

Frequently asked questions

Is this vulnerability being actively exploited?

The sources consulted do not show confirmed exploitation. The record lists the entry as not present in CISA KEV and gives an SSVC exploitation value of none.

What should administrators do?

Check whether your kernel falls within the ranges listed in the record, then apply the stable update from your distribution or the Linux stable branch that includes the upstream fix.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.