CVE-2026-64034 Details

A time-of-check to time-of-use (TOCTOU) vulnerability has been identified in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver. This issue arises in the 'mana_hwc_rx_event_handler()' function, where the 'hwc_msg_id' is read from a Direct Memory Access (DMA)-coherent buffer. Although the value is initially bounds-checked, it is subsequently re-read from the same buffer in the 'mana_hwc_handle_resp()' function for bit testing and pointer arithmetic. This double-fetch creates a window of opportunity for hardware to alter the 'hwc_msg_id' between the validation check and its actual use, potentially leading to improper bounds validation. The vulnerability is particularly concerning in Confidential Virtual Machines (CVMs) using SEV-SNP or TDX, where DMA memory is shared, unencrypted, and directly visible to the host, allowing for such modifications.

The vulnerability has been addressed by modifying the driver to read the 'hwc_msg_id' only once, using the 'READ_ONCE()' function to ensure a consistent and validated value is passed to the response handling function. Users should update to the latest version of the Linux kernel where this fix has been applied.