MANA, the Linux networking driver, fails to perform the necessary DMA synchronization when allocating receive buffers composed of multiple fragments. When a packet arrives and the fragment count exceeds one, the driver keeps the buffer mapped but does not call dma_unmap_single during the RX completion path. This omission prevents the implicit CPU synchronization that normally makes freshly received packet data visible, so stale or corrupted packet contents can be handed to the networking stack. The resulting kernel instability can manifest as OOPS or panic events, effectively denying service to the system.

All Linux kernel builds that include MANA support and that do not incorporate commit bc650dd5 or later. The flaw is only triggered when explicit DMA synchronisation is required, such as when the kernel is booted with the swiotlb=force parameter or other similar configurations. Any distribution shipping a kernel before that commit on such a configuration is vulnerable.

The CVSS score of 9.8 indicates a high severity result; however, the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is presently uncommon. Based on the description, it is inferred that a remote attacker could send crafted network packets that trigger the missing synchronization, potentially leading to a kernel crash and a denial‑of‑service condition. The likely attack vector is remote network traffic to a device configured with swiotlb=force or other explicit DMA sync settings.