In the Linux kernel, the mana network driver does not verify the packet length reported by the Receive Completion Queue Element supplied by the network interface card. A packet containing an inaccurate length can cause the kernel to process the packet incorrectly, potentially leading to data corruption, crashes, or execution of arbitrary code via kernel memory abuse. The flaw is an input validation weakness, identified as CWE‑125, where untrusted data is trusted without bounds checking.

All Linux kernel builds that include the mana driver and have not incorporated the packet‑length validation patch. Versions are not enumerated, but any kernel image that uses the mana device driver is potentially vulnerable.

The CVSS score of 9.8 indicates a very high severity flaw. The EPSS score of less than 1% indicates that, as of the latest data, exploitation attempts are rare or not observed. The vulnerability is not listed in the CISA KEV catalog. Attackers could potentially exploit the issue by sending specially crafted packets through the mana interface; no public exploitation data is available, but the impact on kernel stability and security makes the risk high for exposed systems.