Executive brief
The MANA network device driver in the Linux kernel incorrectly allocates interrupt vectors (MSI-X) without validating the actual hardware table size, causing a buffer overflow that crashes the system. On high-CPU virtual machines, this flaw allows the driver to read and write beyond allocated memory, resulting in immediate kernel panic and system unavailability.
Technical details
The vulnerability is a buffer overflow in the MANA driver's MSI-X vector initialization. The mana_gd_query_max_resources() function calculates the number of usable MSI-X vectors based on device firmware response and CPU count, but never validates against the actual hardware MSI-X table size reported by the device. When the calculated vector count exceeds the table size (e.g., 1793 vectors on a 1792-vCPU VM with only 1024 table entries), subsequent code in mana_gd_setup_remaining_irqs() attempts to access indices beyond the mapped region, causing a page fault in msix_prepare_msi_desc(). The fix caps num_msix_usable using pci_msix_vec_count() to ensure it never exceeds the actual hardware table capacity. No authentication or user interaction is required—the vulnerability is triggered automatically during driver initialization on affected hardware configurations.
Affected products
- Linux Linux kernel 5.15 through 6.9 and later (MSI-X dynamic allocation support)
Timeline
- 2026-09-17: disclosed
- 2026-08-24: patched: upstream fix merged; stable backports from 2026-09-14