A time‑of‑check to time‑of‑use (TOCTOU) race condition in the Linux kernel’s mana driver allows a second read of the hwc_msg_id field from a DMA–coherent buffer after a bounds check. The kernel performs a bounds validation on the first fetch but then rereads the same field for further processing, enabling an attacker to modify the value between checks and thus bypass the original validation. This can lead to memory corruption, denial of service, or potentially privilege escalation if the attacker can influence the DMA buffer.

All Linux kernel builds that include an unpatched mana driver are affected. The vulnerability applies to any kernel lacking the commit that introduces the READ_ONCE protection for hwc_msg_id. No specific version range is supplied; every kernel with the legacy mana code is potentially vulnerable.

The CVSS score of 9.3 indicates a critical severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely and would probably require an entity capable of writing to shared DMA‑coherent memory, such as a malicious driver or hardware manipulating the DMA buffer. The vulnerability is not listed in CISA’s KEV catalog, implying no publicly known exploits. The most probable attack vector would involve an attacker with the ability to write to the DMA buffer or inject malicious code into the kernel; this inference is based on the description of DMA‑coherent memory being unencrypted and directly host‑visible in Confidential VM environments.