The MANA networking driver in the Linux kernel does not perform the necessary DMA synchronization when allocating receive buffers made of multiple fragments. When fragment count exceeds one, the driver keeps the buffers mapped but never calls dma_unmap_single during the RX completion path, skipping the implicit CPU synchronization that normally makes freshly received packet data visible. The result is that corrupted or stale packet data can be handed to the networking stack, potentially causing kernel instability and crashes.

All distributions that ship a Linux kernel with MANA support and that have not yet incorporated commit bc650dd5. Because the flaw manifests only when a packet is received under a configuration that forces explicit DMA sync (for example with the swiotlb=force boot parameter), any system running a kernel predating that commit on such a configuration is affected.

The CVSS score of 9.8 indicates a high severity vulnerability, yet the EPSS score is less than 1% and it is not listed in the CISA KEV catalog, suggesting low observed exploitation. Based on the description, it is inferred that an attacker with network access could send crafted traffic that triggers the missing sync, leading to kernel Oops or panic and a denial‑of‑service condition. The likely attack vector would be a remote attacker sending specific packets to a device configured with swiotlb=force or other explicit DMA syncing requirements.