CVE-2026-64018
In the Linux kernel, the following vulnerability has been resolved:
net: mana: validate rx_req_idx to prevent out-of-bounds array access
In mana_hwc_rx_event_handler(), rx_req_idx is derived from
sge->address in DMA-coherent memory. In Confidential VMs
(SEV-SNP/TDX), this memory is shared unencrypted and HW can modify
WQE contents at any time. No bounds check exists on rx_req_idx,
which can lead to an out-of-bounds access into reqs[].
Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before
using it to index the reqs[] array.
CSIRTS triage
- What
- Multiple kernel vulnerabilities affect Red Hat Linux systems.
- Who is affected
- Red Hat Linux systems running affected kernel versions are vulnerable.
- Urgency
- Kernel vulnerabilities often enable privilege escalation; patch promptly.
- Action
- Apply Red Hat kernel security updates via package manager.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-64018
Get an email if CVE-2026-64018 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
Advisory coverage (24)
- unknownRedHat Linux Kernel Multiple Vulnerabilitieshkcert · 2026-09-02
- unknownUSN-8668-1: Linux kernel (GCP) vulnerabilitiesubuntu · 2026-08-21
- unknownUSN-8664-1: Linux kernel (NVIDIA BaseOS) vulnerabilitiesubuntu · 2026-08-20
- unknownUSN-8663-1: Linux kernel (NVIDIA) vulnerabilitiesubuntu · 2026-08-20
- unknownUSN-8620-4: Linux kernel (Intel IoTG) vulnerabilitiesubuntu · 2026-07-31
- unknownUSN-8620-3: Linux kernel (Intel IoTG) vulnerabilitiesubuntu · 2026-07-31
- unknownUSN-8620-2: Linux kernel (Azure FIPS) vulnerabilitiesubuntu · 2026-07-29
- highUSN-8620-1: Linux kernel vulnerabilitiesubuntu · 2026-07-28
- highUSN-8618-1: Linux kernel vulnerabilitiesubuntu · 2026-07-28
- highUSN-8610-1: Linux kernel (Azure CVM) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8575-3: Linux kernel vulnerabilitiesubuntu · 2026-07-24
- highUSN-8609-1: Linux kernel (Azure CVM) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8608-1: Linux kernel (Azure FIPS) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8607-1: Linux kernel (Azure CVM) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8606-1: Linux kernel (Azure) vulnerabilitiesubuntu · 2026-07-24
- unknownUSN-8605-1: Linux kernel (Azure CVM) vulnerabilitiesubuntu · 2026-07-24
- unknownUSN-8604-1: Linux kernel (Azure) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8603-1: Linux kernel (Azure) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8576-2: Linux kernel (NVIDIA Tegra) vulnerabilitiesubuntu · 2026-07-23
- highUSN-8575-2: Linux kernel vulnerabilitiesubuntu · 2026-07-23
- highUSN-8593-1: Linux kernel vulnerabilitiesubuntu · 2026-07-23
- highUSN-8576-1: Linux kernel (NVIDIA Tegra) vulnerabilitiesubuntu · 2026-07-21
- highUSN-8575-1: Linux kernel vulnerabilitiesubuntu · 2026-07-21
- criticalCVE-2026-64018: In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req…nvd · 2026-07-19
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-64018)