Vulnerability-Lookup

GHSA-FH7X-649R-3P95

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Sync page pool RX frags for CPU

MANA allocates RX buffers from page pool fragments when frag_count is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call dma_unmap_single(). As a result, the implicit sync-for-CPU normally performed by dma_unmap_single() is missing before the packet data is passed to the networking stack.

This breaks RX on configurations which require explicit DMA syncing, for example when booted with swiotlb=force.

Fix this by recording the page pool page and DMA sync offset when the RX buffer is allocated, and syncing the received packet range for CPU access before handing the RX buffer to the stack.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-72064"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:21:16Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Sync page pool RX frags for CPU\n\nMANA allocates RX buffers from page pool fragments when frag_count is\ngreater than 1. In that case the buffers remain DMA mapped by page pool\nand the RX completion path does not call dma_unmap_single(). As a result,\nthe implicit sync-for-CPU normally performed by dma_unmap_single() is\nmissing before the packet data is passed to the networking stack.\n\nThis breaks RX on configurations which require explicit DMA syncing, for\nexample when booted with swiotlb=force.\n\nFix this by recording the page pool page and DMA sync offset when the RX\nbuffer is allocated, and syncing the received packet range for CPU access\nbefore handing the RX buffer to the stack.",
  "id": "GHSA-fh7x-649r-3p95",
  "modified": "2026-08-17T06:33:07Z",
  "published": "2026-08-15T06:32:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72064"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bc650dd5ce6434286b96e2b26a41af81f679cc7c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c72a0f09c57f92113df69f9b902d11c9e4b132f5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-72064 (GCVE-0-2026-72064)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-17 05:39

Title

net: mana: Sync page pool RX frags for CPU

Summary

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when frag_count is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call dma_unmap_single(). As a result, the implicit sync-for-CPU normally performed by dma_unmap_single() is missing before the packet data is passed to the networking stack. This breaks RX on configurations which require explicit DMA syncing, for example when booted with swiotlb=force. Fix this by recording the page pool page and DMA sync offset when the RX buffer is allocated, and syncing the received packet range for CPU access before handing the RX buffer to the stack.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/bc650dd5ce6434286…
https://git.kernel.org/stable/c/c72a0f09c57f92113…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 730ff06d3f5cc2ce0348414b78c10528b767d4a3 , < bc650dd5ce6434286b96e2b26a41af81f679cc7c (git) Affected: 730ff06d3f5cc2ce0348414b78c10528b767d4a3 , < c72a0f09c57f92113df69f9b902d11c9e4b132f5 (git)
Linux	Linux	Affected: 6.18 Unaffected: 0 , < 6.18 (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/mana_en.c",
            "include/net/mana/mana.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bc650dd5ce6434286b96e2b26a41af81f679cc7c",
              "status": "affected",
              "version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3",
              "versionType": "git"
            },
            {
              "lessThan": "c72a0f09c57f92113df69f9b902d11c9e4b132f5",
              "status": "affected",
              "version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/mana_en.c",
            "include/net/mana/mana.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Sync page pool RX frags for CPU\n\nMANA allocates RX buffers from page pool fragments when frag_count is\ngreater than 1. In that case the buffers remain DMA mapped by page pool\nand the RX completion path does not call dma_unmap_single(). As a result,\nthe implicit sync-for-CPU normally performed by dma_unmap_single() is\nmissing before the packet data is passed to the networking stack.\n\nThis breaks RX on configurations which require explicit DMA syncing, for\nexample when booted with swiotlb=force.\n\nFix this by recording the page pool page and DMA sync offset when the RX\nbuffer is allocated, and syncing the received packet range for CPU access\nbefore handing the RX buffer to the stack."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the MANA Ethernet RX completion path (MSI-X/NAPI \u2192 mana_process_rx_cqe \u2192 mana_refill_rx_oob \u2192 mana_rx_skb) on Azure/cloud VMs; any remote host that can send IP traffic to the MANA interface drives packet reception before authentication or local privilege checks.\nAC:L - On deployments where DMA needs explicit CPU sync (e.g. swiotlb=force or non-coherent DMA), every received frame on the default standard-MTU page-pool-fragment path (frag_count\u003e1) deterministically skips sync; the attacker only sends network packets with no race, layout gamble, or timing window.\nPR:N - Exploitation requires no credentials or local access; the vulnerable code runs in hardware interrupt/NAPI context on inbound packets and is not gated by capabilities, netlink, ioctl, or user namespaces.\nUI:N - Packet reception and handoff to the networking stack occur automatically once the MANA interface is up; no victim mount, click, or other administrative action is required beyond normal network operation.\nS:U - Impact is confined to incorrect/stale packet data processed inside the same guest kernel and network stack; it does not cross a VM-host, IOMMU, or other separate security boundary.\nC:H - Without dma_sync_for_cpu the CPU can read stale cache or bounce-buffer contents for the full received length (up to MTU) instead of hardware-written data, disclosing prior RX buffer or unrelated DMA residue to the stack, XDP, or applications.\nI:H - The skb handed upward can contain bytes that differ from the frame the NIC actually wrote, corrupting protocol parsing and application-visible payload integrity across the entire packet, not just a bounded tail region.\nA:H - On configurations requiring explicit DMA syncing the driver commit reports RX is broken entirely; a remote sender can repeatedly trigger the faulty path and deny reliable receive on the MANA interface."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:55.896Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bc650dd5ce6434286b96e2b26a41af81f679cc7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c72a0f09c57f92113df69f9b902d11c9e4b132f5"
        }
      ],
      "title": "net: mana: Sync page pool RX frags for CPU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72064",
    "datePublished": "2026-08-15T05:52:18.069Z",
    "dateReserved": "2026-08-09T03:40:39.903Z",
    "dateUpdated": "2026-08-17T05:39:55.896Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-FH7X-649R-3P95

CVE-2026-72064 (GCVE-0-2026-72064)

Tags

Sightings

Nomenclature