CVE-2026-72064: Linux kernel mana driver: missing page pool RX sync for CPU

Overview

The mana network driver in the Linux kernel allocates receive buffers from page pool fragments when the fragment count is greater than one. These buffers stay DMA mapped through the page pool, and the receive completion path skips the unmap call that would normally synchronize the data for CPU access. The fix records the page pool page and DMA sync offset at allocation time and syncs the received packet range before the buffer is handed to the networking stack.

Impact

• The record describes broken receive behaviour on configurations that require explicit DMA syncing, such as systems booted with swiotlb forced.
• The record's CVSS 3.1 score of 9.8 uses a network attack vector, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. This is the score recorded in the sources, not an independent assessment.
• The record classifies the weakness as CWE-362 (Race Condition), but the description does not detail a race window. The exact security effect is not described in the sources.

Affected products and versions

• The record lists the product as Linux Linux.
• Affected ranges start at commit 730ff06d3f5cc2ce0348414b78c10528b767d4a3 and end before several fixed commits, including 845c959178ccab020b67bed7f4eae3058135ec80.
• The record also lists version 6.18 as affected.
• Check the stable kernel references for the exact branch-by-branch ranges.

Exploitation status

• CISA KEV does not list this CVE in the record.
• SSVC exploitation is recorded as none, and the EPSS probability is 0.00502 (percentile 0.42057).
• No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

• Apply the stable kernel updates that include the referenced commits, or a distribution kernel that backports them.
• The record does not provide a fixed version string, so use the linked commits to confirm whether your kernel branch includes the change.
• Until patched, review network receive behaviour on hosts using the mana driver, especially those using forced bounce buffering. This is an inference from the description.

Detection guidance

• Confirm the running kernel build against the referenced commits.
• Watch for corrupted or inconsistent payloads on hosts using the mana driver, particularly where bounce buffering is enabled.
• Review kernel logs for DMA or swiotlb messages during periods of network activity. This is an inference and may not produce clear indicators.

Limitations of the available information

• The sources provide no proof of concept, no reported incidents and no vendor advisory text beyond the kernel commit descriptions.
• Exact fixed-version boundaries for each stable branch are not in the record.
• The record does not state whether the defect is reachable in a default configuration.

Frequently asked questions

What does CVE-2026-72064 affect?

The record describes the Linux kernel mana network driver. It lists affected ranges starting at commit 730ff06d3f5cc2ce0348414b78c10528b767d4a3 and also lists version 6.18.

Is this CVE being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. SSVC exploitation is recorded as none.

What is the main impact described?

The record describes broken receive behaviour on configurations requiring explicit DMA syncing, such as systems booted with swiotlb forced. The recorded CVSS 3.1 score is 9.8.

How should administrators respond?

Apply stable or distribution kernel updates that include the referenced commits, and verify your kernel build against those commits. The record does not give a single fixed version string.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.