Executive brief
A vulnerability was identified in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver. In certain high-security 'Confidential VM' environments, the hardware could potentially modify memory in a way that causes the driver to access data outside of its intended boundaries. This could lead to system instability or unauthorized access to kernel memory.
Technical details
An out-of-bounds array access vulnerability exists in the mana_hwc_rx_event_handler() function within the Microsoft Azure Network Adapter (MANA) driver (drivers/net/ethernet/microsoft/mana/hw_channel.c). The variable rx_req_idx is derived from sge->address in DMA-coherent memory without proper bounds checking. In Confidential Computing environments (such as AMD SEV-SNP or Intel TDX), this memory is shared unencrypted, allowing a malicious or compromised hardware interface to modify Work Queue Entry (WQE) contents. An attacker could manipulate these values to trigger an out-of-bounds access into the reqs[] array. The issue has been resolved by adding a explicit bounds check against num_reqs before indexing the array.
Affected products
- Linux Linux Kernel 5.13 to 6.18.34
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01
- https://git.kernel.org/stable/c/355e9f2b2a7887ca38100127989af3e422ba71d0
- https://git.kernel.org/stable/c/5ddc715324badd7f2641bc177db1d027b402adae
- https://git.kernel.org/stable/c/763a372d344fb12fae566d36ddb46e92454ad58c
- https://git.kernel.org/stable/c/b809d0409991b75a6cff846a5ac27c3062953f84
- https://git.kernel.org/stable/c/fa627a5eaa83fc0261f44ef3769693b886ca6e27
- https://git.kernel.org/stable/c/ff1d5af207bcea857d45fe81505f1bc4b29eaef0