GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72064 (GCVE-0-2026-72064)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-17 05:39
VLAI
Title
net: mana: Sync page pool RX frags for CPU
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when frag_count is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call dma_unmap_single(). As a result, the implicit sync-for-CPU normally performed by dma_unmap_single() is missing before the packet data is passed to the networking stack. This breaks RX on configurations which require explicit DMA syncing, for example when booted with swiotlb=force. Fix this by recording the page pool page and DMA sync offset when the RX buffer is allocated, and syncing the received packet range for CPU access before handing the RX buffer to the stack.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 730ff06d3f5cc2ce0348414b78c10528b767d4a3 , < bc650dd5ce6434286b96e2b26a41af81f679cc7c (git)
Affected: 730ff06d3f5cc2ce0348414b78c10528b767d4a3 , < c72a0f09c57f92113df69f9b902d11c9e4b132f5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/mana_en.c",
            "include/net/mana/mana.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bc650dd5ce6434286b96e2b26a41af81f679cc7c",
              "status": "affected",
              "version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3",
              "versionType": "git"
            },
            {
              "lessThan": "c72a0f09c57f92113df69f9b902d11c9e4b132f5",
              "status": "affected",
              "version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/mana_en.c",
            "include/net/mana/mana.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Sync page pool RX frags for CPU\n\nMANA allocates RX buffers from page pool fragments when frag_count is\ngreater than 1. In that case the buffers remain DMA mapped by page pool\nand the RX completion path does not call dma_unmap_single(). As a result,\nthe implicit sync-for-CPU normally performed by dma_unmap_single() is\nmissing before the packet data is passed to the networking stack.\n\nThis breaks RX on configurations which require explicit DMA syncing, for\nexample when booted with swiotlb=force.\n\nFix this by recording the page pool page and DMA sync offset when the RX\nbuffer is allocated, and syncing the received packet range for CPU access\nbefore handing the RX buffer to the stack."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the MANA Ethernet RX completion path (MSI-X/NAPI \u2192 mana_process_rx_cqe \u2192 mana_refill_rx_oob \u2192 mana_rx_skb) on Azure/cloud VMs; any remote host that can send IP traffic to the MANA interface drives packet reception before authentication or local privilege checks.\nAC:L - On deployments where DMA needs explicit CPU sync (e.g. swiotlb=force or non-coherent DMA), every received frame on the default standard-MTU page-pool-fragment path (frag_count\u003e1) deterministically skips sync; the attacker only sends network packets with no race, layout gamble, or timing window.\nPR:N - Exploitation requires no credentials or local access; the vulnerable code runs in hardware interrupt/NAPI context on inbound packets and is not gated by capabilities, netlink, ioctl, or user namespaces.\nUI:N - Packet reception and handoff to the networking stack occur automatically once the MANA interface is up; no victim mount, click, or other administrative action is required beyond normal network operation.\nS:U - Impact is confined to incorrect/stale packet data processed inside the same guest kernel and network stack; it does not cross a VM-host, IOMMU, or other separate security boundary.\nC:H - Without dma_sync_for_cpu the CPU can read stale cache or bounce-buffer contents for the full received length (up to MTU) instead of hardware-written data, disclosing prior RX buffer or unrelated DMA residue to the stack, XDP, or applications.\nI:H - The skb handed upward can contain bytes that differ from the frame the NIC actually wrote, corrupting protocol parsing and application-visible payload integrity across the entire packet, not just a bounded tail region.\nA:H - On configurations requiring explicit DMA syncing the driver commit reports RX is broken entirely; a remote sender can repeatedly trigger the faulty path and deny reliable receive on the MANA interface."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:55.896Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bc650dd5ce6434286b96e2b26a41af81f679cc7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c72a0f09c57f92113df69f9b902d11c9e4b132f5"
        }
      ],
      "title": "net: mana: Sync page pool RX frags for CPU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72064",
    "datePublished": "2026-08-15T05:52:18.069Z",
    "dateReserved": "2026-08-09T03:40:39.903Z",
    "dateUpdated": "2026-08-17T05:39:55.896Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72064",
      "date": "2026-09-04",
      "epss": "0.00553",
      "percentile": "0.44139"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72064\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:16.003\",\"lastModified\":\"2026-08-17T06:18:04.810\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: mana: Sync page pool RX frags for CPU\\n\\nMANA allocates RX buffers from page pool fragments when frag_count is\\ngreater than 1. In that case the buffers remain DMA mapped by page pool\\nand the RX completion path does not call dma_unmap_single(). As a result,\\nthe implicit sync-for-CPU normally performed by dma_unmap_single() is\\nmissing before the packet data is passed to the networking stack.\\n\\nThis breaks RX on configurations which require explicit DMA syncing, for\\nexample when booted with swiotlb=force.\\n\\nFix this by recording the page pool page and DMA sync offset when the RX\\nbuffer is allocated, and syncing the received packet range for CPU access\\nbefore handing the RX buffer to the stack.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/microsoft/mana/mana_en.c\",\"include/net/mana/mana.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"730ff06d3f5cc2ce0348414b78c10528b767d4a3\",\"lessThan\":\"bc650dd5ce6434286b96e2b26a41af81f679cc7c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"730ff06d3f5cc2ce0348414b78c10528b767d4a3\",\"lessThan\":\"c72a0f09c57f92113df69f9b902d11c9e4b132f5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/microsoft/mana/mana_en.c\",\"include/net/mana/mana.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/bc650dd5ce6434286b96e2b26a41af81f679cc7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c72a0f09c57f92113df69f9b902d11c9e4b132f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T19:29:39+00:00",
      "cve": "CVE-2026-72064",
      "id": "CVE-2026-72064",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: mana: Sync page pool RX frags for CPU",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72064.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.