Executive brief
A vulnerability was identified in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver. In certain high-security 'Confidential VM' environments, a malicious host could potentially modify data in shared memory after the system has verified it but before it is used. This could lead to unauthorized memory access or system instability within the virtual machine.
Technical details
A TOCTOU double-fetch vulnerability exists in drivers/net/ethernet/microsoft/mana/hw_channel.c. In mana_hwc_rx_event_handler(), the field hwc_msg_id is read from DMA-coherent memory and bounds-checked. However, mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for use in test_bit() and pointer arithmetic. In Confidential Computing environments (SEV-SNP/TDX), DMA memory is shared and unencrypted, allowing a malicious or compromised host/hardware to modify the value between the check and the use. This bypasses bounds validation and can lead to out-of-bounds memory access. The fix implements READ_ONCE() to ensure the value is fetched into a local stack variable only once.
Affected products
- Linux Linux Kernel 5.13 to 6.1.175
Timeline
- 2026-05-14: patched: Initial patch submitted by Microsoft
- 2026-07-19: disclosed: CVE-2026-64034 published
References
- https://git.kernel.org/stable/c/09ec063d87c2dd3fa6f3561361a017bd882e9f37
- https://git.kernel.org/stable/c/35f0f0a2536a4d604b4dbad92c85c4a8fdebb870
- https://git.kernel.org/stable/c/3c4db56ccd13dd020fbf43afabaee74a40ec75e4
- https://git.kernel.org/stable/c/566f42fb67a7ebfed6650e407e5b72e6b3e83bf7
- https://git.kernel.org/stable/c/6180a06bbc99fd9114b8db4be6c4d46e40f046ef
- https://git.kernel.org/stable/c/70ad2dff8d052a85dfef15715b531f38a29108cf
- https://git.kernel.org/stable/c/a201c66edf2ebc6cfdc3813a889ba20fecebfae3