CVE-2026-72064

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72064", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.903Z", "datePublished": "2026-08-15T05:52:18.069Z", "dateUpdated": "2026-10-19T21:19:25.844Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-11T13:47:09.405Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Sync page pool RX frags for CPU\n\nMANA allocates RX buffers from page pool fragments when frag_count is\ngreater than 1. In that case the buffers remain DMA mapped by page pool\nand the RX completion path does not call dma_unmap_single(). As a result,\nthe implicit sync-for-CPU normally performed by dma_unmap_single() is\nmissing before the packet data is passed to the networking stack.\n\nThis breaks RX on configurations which require explicit DMA syncing, for\nexample when booted with swiotlb=force.\n\nFix this by recording the page pool page and DMA sync offset when the RX\nbuffer is allocated, and syncing the received packet range for CPU access\nbefore handing the RX buffer to the stack."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in the MANA Ethernet RX completion path (MSI-X/NAPI \u2192 mana_process_rx_cqe \u2192 mana_refill_rx_oob \u2192 mana_rx_skb) on Azure/cloud VMs; any remote host that can send IP traffic to the MANA interface drives packet reception before authentication or local privilege checks.\nAC:L - On deployments where DMA needs explicit CPU sync (e.g. swiotlb=force or non-coherent DMA), every received frame on the default standard-MTU page-pool-fragment path (frag_count>1) deterministically skips sync; the attacker only sends network packets with no race, layout gamble, or timing window.\nPR:N - Exploitation requires no credentials or local access; the vulnerable code runs in hardware interrupt/NAPI context on inbound packets and is not gated by capabilities, netlink, ioctl, or user namespaces.\nUI:N - Packet reception and handoff to the networking stack occur automatically once the MANA interface is up; no victim mount, click, or other administrative action is required beyond normal network operation.\nS:U - Impact is confined to incorrect/stale packet data processed inside the same guest kernel and network stack; it does not cross a VM-host, IOMMU, or other separate security boundary.\nC:H - Without dma_sync_for_cpu the CPU can read stale cache or bounce-buffer contents for the full received length (up to MTU) instead of hardware-written data, disclosing prior RX buffer or unrelated DMA residue to the stack, XDP, or applications.\nI:H - The skb handed upward can contain bytes that differ from the frame the NIC actually wrote, corrupting protocol parsing and application-visible payload integrity across the entire packet, not just a bounded tail region.\nA:H - On configurations requiring explicit DMA syncing the driver commit reports RX is broken entirely; a remote sender can repeatedly trigger the faulty path and deny reliable receive on the MANA interface."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microsoft/mana/mana_en.c", "include/net/mana/mana.h"], "versions": [{"version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3", "lessThan": "845c959178ccab020b67bed7f4eae3058135ec80", "status": "affected", "versionType": "git"}, {"version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3", "lessThan": "bc650dd5ce6434286b96e2b26a41af81f679cc7c", "status": "affected", "versionType": "git"}, {"version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3", "lessThan": "c72a0f09c57f92113df69f9b902d11c9e4b132f5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microsoft/mana/mana_en.c", "include/net/mana/mana.h"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/845c959178ccab020b67bed7f4eae3058135ec80"}, {"url": "https://git.kernel.org/stable/c/bc650dd5ce6434286b96e2b26a41af81f679cc7c"}, {"url": "https://git.kernel.org/stable/c/c72a0f09c57f92113df69f9b902d11c9e4b132f5"}], "title": "net: mana: Sync page pool RX frags for CPU", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72064", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:51:11.034723Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T21:19:25.844Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72064", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:51:11.034723Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:51:11.641Z"}}], "cna": {"title": "net: mana: Sync page pool RX frags for CPU", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in the MANA Ethernet RX completion path (MSI-X/NAPI \u2192 mana_process_rx_cqe \u2192 mana_refill_rx_oob \u2192 mana_rx_skb) on Azure/cloud VMs; any remote host that can send IP traffic to the MANA interface drives packet reception before authentication or local privilege checks.\nAC:L - On deployments where DMA needs explicit CPU sync (e.g. swiotlb=force or non-coherent DMA), every received frame on the default standard-MTU page-pool-fragment path (frag_count>1) deterministically skips sync; the attacker only sends network packets with no race, layout gamble, or timing window.\nPR:N - Exploitation requires no credentials or local access; the vulnerable code runs in hardware interrupt/NAPI context on inbound packets and is not gated by capabilities, netlink, ioctl, or user namespaces.\nUI:N - Packet reception and handoff to the networking stack occur automatically once the MANA interface is up; no victim mount, click, or other administrative action is required beyond normal network operation.\nS:U - Impact is confined to incorrect/stale packet data processed inside the same guest kernel and network stack; it does not cross a VM-host, IOMMU, or other separate security boundary.\nC:H - Without dma_sync_for_cpu the CPU can read stale cache or bounce-buffer contents for the full received length (up to MTU) instead of hardware-written data, disclosing prior RX buffer or unrelated DMA residue to the stack, XDP, or applications.\nI:H - The skb handed upward can contain bytes that differ from the frame the NIC actually wrote, corrupting protocol parsing and application-visible payload integrity across the entire packet, not just a bounded tail region.\nA:H - On configurations requiring explicit DMA syncing the driver commit reports RX is broken entirely; a remote sender can repeatedly trigger the faulty path and deny reliable receive on the MANA interface."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3", "lessThan": "845c959178ccab020b67bed7f4eae3058135ec80", "versionType": "git"}, {"status": "affected", "version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3", "lessThan": "bc650dd5ce6434286b96e2b26a41af81f679cc7c", "versionType": "git"}, {"status": "affected", "version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3", "lessThan": "c72a0f09c57f92113df69f9b902d11c9e4b132f5", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/microsoft/mana/mana_en.c", "include/net/mana/mana.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"status": "unaffected", "version": "0", "lessThan": "6.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.56", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/microsoft/mana/mana_en.c", "include/net/mana/mana.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/845c959178ccab020b67bed7f4eae3058135ec80"}, {"url": "https://git.kernel.org/stable/c/bc650dd5ce6434286b96e2b26a41af81f679cc7c"}, {"url": "https://git.kernel.org/stable/c/c72a0f09c57f92113df69f9b902d11c9e4b132f5"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Sync page pool RX frags for CPU\n\nMANA allocates RX buffers from page pool fragments when frag_count is\ngreater than 1. In that case the buffers remain DMA mapped by page pool\nand the RX completion path does not call dma_unmap_single(). As a result,\nthe implicit sync-for-CPU normally performed by dma_unmap_single() is\nmissing before the packet data is passed to the networking stack.\n\nThis breaks RX on configurations which require explicit DMA syncing, for\nexample when booted with swiotlb=force.\n\nFix this by recording the page pool page and DMA sync offset when the RX\nbuffer is allocated, and syncing the received packet range for CPU access\nbefore handing the RX buffer to the stack."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.56", "versionStartIncluding": "6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-11T13:47:09.405Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72064", "state": "PUBLISHED", "dateUpdated": "2026-10-19T21:19:25.844Z", "dateReserved": "2026-08-09T03:40:39.903Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:52:18.069Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/microsoft/mana/mana_en.c", "include/net/mana/mana.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "845c959178ccab020b67bed7f4eae3058135ec80", "status": "affected", "version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3", "versionType": "git"}, {"lessThan": "bc650dd5ce6434286b96e2b26a41af81f679cc7c", "status": "affected", "version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3", "versionType": "git"}, {"lessThan": "c72a0f09c57f92113df69f9b902d11c9e4b132f5", "status": "affected", "version": "730ff06d3f5cc2ce0348414b78c10528b767d4a3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/microsoft/mana/mana_en.c", "include/net/mana/mana.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Sync page pool RX frags for CPU\n\nMANA allocates RX buffers from page pool fragments when frag_count is\ngreater than 1. In that case the buffers remain DMA mapped by page pool\nand the RX completion path does not call dma_unmap_single(). As a result,\nthe implicit sync-for-CPU normally performed by dma_unmap_single() is\nmissing before the packet data is passed to the networking stack.\n\nThis breaks RX on configurations which require explicit DMA syncing, for\nexample when booted with swiotlb=force.\n\nFix this by recording the page pool page and DMA sync offset when the RX\nbuffer is allocated, and syncing the received packet range for CPU access\nbefore handing the RX buffer to the stack."}], "id": "CVE-2026-72064", "lastModified": "2026-10-19T22:17:25.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72064", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:51:11.034723Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:21:16.003", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/845c959178ccab020b67bed7f4eae3058135ec80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bc650dd5ce6434286b96e2b26a41af81f679cc7c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c72a0f09c57f92113df69f9b902d11c9e4b132f5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: net: mana: Sync page pool RX frags for CPU", "id": "2516559", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516559"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-820", "details": ["A flaw was found in the Linux kernel's mana network driver. When the driver allocates receive (RX) buffers from page pool fragments, it fails to perform an explicit synchronization for the CPU. This oversight can lead to data integrity issues or system instability on systems configured to require explicit Direct Memory Access (DMA) syncing."], "name": "CVE-2026-72064", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72064\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72064\nhttps://lore.kernel.org/linux-cve-announce/2026081518-CVE-2026-72064-a04c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[730ff06d3f5cc2ce0348414b78c10528b767d4a3,bc650dd5ce6434286b96e2b26a41af81f679cc7c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[730ff06d3f5cc2ce0348414b78c10528b767d4a3,c72a0f09c57f92113df69f9b902d11c9e4b132f5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.5,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T10:45:06.864951+00:00", "updated": "2026-10-20T13:00:12.992115+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}