In the Linux kernel, the mana network driver processes packets without validating the length reported by the NIC in its Receive Completion Queue Element. This input‑validation flaw (CWE-125 and CWE-20) may cause the kernel to read beyond intended bounds. Based on the description, it is inferred that such a bounds violation could lead to kernel crashes or allow an attacker to execute arbitrary code in kernel space.

All Linux kernel builds that include the mana driver and have not incorporated the packet‑length validation patch are potentially affected. Any unpatched kernel using the mana interface is at risk.

The flaw has a CVSS score of 9.8, indicating a very high severity. The EPSS score is less than 1%, meaning that exploitation attempts are currently rare, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is a malicious network packet sent to the mana interface, which could trigger a kernel crash or privilege escalation if the attacker can control the packet length.