kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access

A flaw was found in the Linux kernel's mana network driver. In Confidential Virtual Machines VMs, a missing bounds check when processing network events can allow a malicious hardware component or a compromised VM to write data outside of an intended memory region. This out-of-bounds access could...

kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access

A flaw was found in the Linux kernel's mana network driver. In Confidential Virtual Machines VMs, a missing bounds check when processing network events can allow a malicious hardware component or a compromised VM to write data outside of an intended memory region. This out-of-bounds access could...

kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access

A flaw was found in the Linux kernel's mana network driver. In Confidential Virtual Machines VMs, a missing bounds check when processing network events can allow a malicious hardware component or a compromised VM to write data outside of an intended memory region. This out-of-bounds access could...

The vulnerability of the `mana_hwcDestroyChannel()` function in the `drivers/net/ethernet/microsoft/mana/hw_channel.c` file of the Ethernet network adapter driver in Microsoft’s Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the manahwcDestroyChannel function in the drivers/net/ethernet/microsoft/mana/hwchannel.c file of the Ethernet network adapter driver in Microsoft’s Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker ...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: mana: Fixed error handling for TX CQE messages. For an unknown type of TX CQE error likely due to newer hardware, still free the SKB, update the queue tail, etc. Otherwise, the accounting data will be incorrect...

CVE-2026-74265

A flaw was found in the mana network driver of the Linux kernel. When creating a General DMA GDMA queue, the queue-id may not be properly initialized. If the queue creation fails before a valid ID is assigned, a subsequent cleanup operation can incorrectly use a zero ID, potentially corrupting th...

Linux Distros Unpatched Vulnerability : CVE-2026-74265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: mana: initialize gdma queue id to INVALIDQUEUEID managdcreatemanawqcq leaves queue-id as 0 from kzallocobj until manacreatewqobj assigns the...

CVE-2026-72064

A flaw was found in the Linux kernel's mana network driver. When the driver allocates receive RX buffers from page pool fragments, it fails to perform an explicit synchronization for the CPU. This oversight can lead to data integrity issues or system instability on systems configured to require...

CVE-2026-72065

A flaw was found in the Linux kernel's mana network driver. This vulnerability arises from the driver's failure to validate the packet length reported by the Network Interface Card NIC within the Receive Completion Queue Entry RX CQE before further processing. A malicious NIC, or an attacker...

CVE-2026-74265

In the Linux kernel, the following vulnerability has been resolved: net: mana: initialize gdma queue id to INVALIDQUEUEID managdcreatemanawqcq leaves queue-id as 0 from kzallocobj until manacreatewqobj assigns the firmware-returned id. If creation fails before that, cleanup calls managddestroycq...

UBUNTU-CVE-2026-74265

In the Linux kernel, the following vulnerability has been resolved: net: mana: initialize gdma queue id to INVALIDQUEUEID managdcreatemanawqcq leaves queue-id as 0 from kzallocobj until manacreatewqobj assigns the firmware-returned id. If creation fails before that, cleanup calls managddestroycq...

CVE-2026-74265

In the Linux kernel, the following vulnerability has been resolved: net: mana: initialize gdma queue id to INVALIDQUEUEID managdcreatemanawqcq leaves queue-id as 0 from kzallocobj until manacreatewqobj assigns the firmware-returned id. If creation fails before that, cleanup calls managddestroycq...

CVE-2026-72064

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

CVE-2026-72065

In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted...

CVE-2026-72065

In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted...

UBUNTU-CVE-2026-72064

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

CVE-2026-72064

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

UBUNTU-CVE-2026-72065

In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted...

CVE-2026-74265 net: mana: initialize gdma queue id to INVALID_QUEUE_ID

In the Linux kernel, the following vulnerability has been resolved: net: mana: initialize gdma queue id to INVALIDQUEUEID managdcreatemanawqcq leaves queue-id as 0 from kzallocobj until manacreatewqobj assigns the firmware-returned id. If creation fails before that, cleanup calls managddestroycq...

EUVD-2026-59412

In the Linux kernel, the following vulnerability has been resolved: net: mana: initialize gdma queue id to INVALIDQUEUEID managdcreatemanawqcq leaves queue-id as 0 from kzallocobj until manacreatewqobj assigns the firmware-returned id. If creation fails before that, cleanup calls managddestroycq...