CVE-2026-64034

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Time-of-Check to Time-of-Use (TOCTOU) double-fetch issue exists in the mana hwc rx event handler() function. The hwc msg id is read from DMA-coherent memory and bounds-checked, but is subsequently re-read from the same DMA buffer within the mana hwc handle resp() function for pointer arithmetic and test bit() operations. Because DMA-coherent memory is shared and host-visible in Confidential VMs (such as SEV-SNP and TDX), hardware could modify the value between the initial check and the subsequent use, allowing the bounds validation to be bypassed.

Recommendations Update the Linux kernel to a version where the hwc msg id is read only once using READ ONCE() into a stack-local variable within mana hwc rx event handler() and passed as a parameter to mana hwc handle resp().