Bug 2502394 (CVE-2026-64034)

Summary: CVE-2026-64034 kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use (TOCTOU) vulnerability allows a hardware component to modify a message identifier (hwc_msg_id) in Direct Memory Access (DMA) memory after it has been validated but before it is used. This manipulation bypasses critical bounds validation, potentially leading to unexpected system behavior or security bypasses, particularly in Confidential Virtual Machines (CVMs) where DMA memory is shared and unencrypted.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 16:05:50 UTC 
In the Linux kernel, the following vulnerability has been resolved:

net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from
DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp()
re-reads the same field from the same DMA buffer for test_bit() and
pointer arithmetic.

DMA-coherent memory is mapped uncacheable on x86 and is shared,
unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes
directly to host-visible memory. A H/W can modify the value
between the check and the use, bypassing the bounds validation.

Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a
stack-local variable in mana_hwc_rx_event_handler(), and passing the
validated value as a parameter to mana_hwc_handle_resp().
Comment 1 Keith Grant 2026-07-22 01:07:15 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071904-CVE-2026-64034-6fd0@gregkh/T
Comment 5 errata-xmlrpc 2026-09-09 22:04:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:66180 https://access.redhat.com/errata/RHSA-2026:66180
Comment 6 Jon Orris 2026-09-28 11:13:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:72467 https://access.redhat.com/errata/RHSA-2026:72467
Comment 7 Jon Orris 2026-09-28 12:03:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:72468 https://access.redhat.com/errata/RHSA-2026:72468
Comment 11 Jon Orris 2026-10-05 07:11:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:75576 https://access.redhat.com/errata/RHSA-2026:75576
Comment 14 errata-xmlrpc 2026-11-10 22:13:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:97873 https://access.redhat.com/errata/RHSA-2026:97873