The Linux kernel’s mana driver accepts an index from DMA‑coherent memory without bounds checking (CWE‑787: Out‑of‑Bounds Access) and does not verify that an externally controlled value falls within a safe range. A malicious attacker can alter the DMA memory shared with the host in Confidential Virtual Machine environments such as SEV‑SNP or TDX, causing the kernel to read or write beyond the intended array and corrupt memory. This corruption can be leveraged to modify crucial kernel structures or code, potentially enabling privilege escalation or system compromise.

The flaw affects any Linux kernel that includes the mana hardware‑accelerated networking driver, regardless of distribution. All kernels that compile with this driver should be considered vulnerable until the vendor releases a patch that adds a bounds check to the rx_req_idx value.

The vulnerability has a CVSS score of 9.3, indicating critical severity, yet its EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting limited likelihood of exploitation today. This flaw constitutes a CWE‑787 Out‑of‑Bounds Access. The attack vector requires the attacker to influence or inject data into the DMA memory shared with the host, a capability typically available to the host or a compromised guest in Confidential VM setups. If successful, the out‑of‑bounds access can corrupt arbitrary kernel memory and can lead to privilege escalation or denial‑of‑service.