SB20260816457 - Improper locking in Linux kernel net mana

Description

This security bulletin contains information about 1 vulnerability.

1) Improper locking (CVE-ID: CVE-2026-72064)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization for cpu access in the mana RX buffer handling in the Linux kernel MANA network driver when processing received packets from page pool fragments. A local user can trigger packet reception on an affected interface to cause a denial of service.

The issue occurs when page pool fragments are used with frag_count greater than 1 on configurations that require explicit DMA syncing, such as systems booted with swiotlb=force.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/bc650dd5ce6434286b96e2b26a41af81f679cc7c
• https://git.kernel.org/stable/c/c72a0f09c57f92113df69f9b902d11c9e4b132f5