CVE-2026-64034 (CVSS 9.3)

Description

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic. DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation. Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().

Is your site exposed to CVE-2026-64034?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.3

CRITICAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0015

Probability of exploitation

0.05%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/09ec063d87c2dd3fa6f3561361a017bd882e9f37 https://git.kernel.org/stable/c/35f0f0a2536a4d604b4dbad92c85c4a8fdebb870 https://git.kernel.org/stable/c/3c4db56ccd13dd020fbf43afabaee74a40ec75e4 https://git.kernel.org/stable/c/566f42fb67a7ebfed6650e407e5b72e6b3e83bf7 https://git.kernel.org/stable/c/6180a06bbc99fd9114b8db4be6c4d46e40f046ef https://git.kernel.org/stable/c/70ad2dff8d052a85dfef15715b531f38a29108cf https://git.kernel.org/stable/c/a201c66edf2ebc6cfdc3813a889ba20fecebfae3

Frequently Asked Questions

What is CVE-2026-64034? +

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic. DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation. Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp(). It has a CVSS v3.1 base score of 9.3 (CRITICAL).

How severe is CVE-2026-64034? +

CVE-2026-64034 has a CVSS v3.1 score of 9.3 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0015, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-64034? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-64034