Executive brief
The Microsoft Azure Network Adapter (MANA) driver in the Linux kernel fails to properly synchronize DMA memory when receiving network packets on systems with certain hardware or software configurations. This can cause network reception to fail or data corruption on systems using bounce buffer translation (swiotlb=force) or non-coherent DMA hardware, breaking network connectivity or causing packet loss.
Technical details
The vulnerability is a missing DMA cache coherency sync in the MANA driver's RX path. When MANA allocates RX buffers from page pool fragments (when frag_count > 1), the buffers remain DMA-mapped by the page pool and the RX completion handler does not call dma_unmap_single(). The implicit sync-for-CPU that normally occurs in dma_unmap_single() is therefore skipped, leaving stale data in CPU caches on incoherent systems or bounce buffers unsynced on systems with DMA translation layers. The fix records the page pool page and DMA sync offset during buffer allocation, then explicitly syncs the received packet range for CPU access via page_pool_dma_sync_for_cpu() before passing the buffer to the networking stack. This is a logic error introduced in commit 730ff06d3f5c and requires explicit DMA coherency management. Patches are available upstream and in stable kernels.
Affected products
- Linux Linux kernel 5.15+, 6.0+ (versions with commit 730ff06d3f5c and before fix commit c72a0f09c57f92113df69f9b902d11c9e4b132f5)
Timeline
- 2026-08-15: disclosed: CVE-2026-72064 published
- 2026-07-09: patched: Upstream fix commit c72a0f09c57f92113df69f9b902d11c9e4b132f5
- 2026-07-01: other: Patch authored by Dexuan Cui