Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel - CVE-2026-64034

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass bounds validation.

The vulnerability exists due to a time-of-check time-of-use double-fetch in mana_hwc_rx_event_handler() and mana_hwc_handle_resp() when reading hwc_msg_id from a DMA-coherent buffer. A remote attacker can modify the DMA-visible hwc_msg_id value between reads to bypass bounds validation.

Exploitation requires hardware or a host environment able to alter shared, unencrypted DMA-coherent memory between the check and the subsequent use, such as in confidential VM environments.

How to mitigate CVE-2026-64034

Sources

• https://git.kernel.org/stable/c/09ec063d87c2dd3fa6f3561361a017bd882e9f37
• https://git.kernel.org/stable/c/35f0f0a2536a4d604b4dbad92c85c4a8fdebb870
• https://git.kernel.org/stable/c/3c4db56ccd13dd020fbf43afabaee74a40ec75e4
• https://git.kernel.org/stable/c/566f42fb67a7ebfed6650e407e5b72e6b3e83bf7
• https://git.kernel.org/stable/c/6180a06bbc99fd9114b8db4be6c4d46e40f046ef
• https://git.kernel.org/stable/c/70ad2dff8d052a85dfef15715b531f38a29108cf
• https://git.kernel.org/stable/c/a201c66edf2ebc6cfdc3813a889ba20fecebfae3