Improper locking in Linux kernel - CVE-2026-72064

Vulnerability identifier: #VU143521

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-72064

CWE-ID: CWE-667

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization for cpu access in the mana RX buffer handling in the Linux kernel MANA network driver when processing received packets from page pool fragments. A local user can trigger packet reception on an affected interface to cause a denial of service.

The issue occurs when page pool fragments are used with frag_count greater than 1 on configurations that require explicit DMA syncing, such as systems booted with swiotlb=force.

Linux kernel
Ubuntu
linux-azure (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-azure-fde-6.8 (Ubuntu package)
linux-azure-6.8 (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux (Ubuntu package)
linux-realtime (Ubuntu package)
linux-gcp (Ubuntu package)
linux-aws (Ubuntu package)
linux-oracle (Ubuntu package)
linux-raspi (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-ibm (Ubuntu package)
linux-nvidia-bos (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-gke (Ubuntu package)
linux-aws-7.0 (Ubuntu package)
linux-nvidia-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-azure (Ubuntu package) - addressed in versions 6.8.0-1070.78, 7.0.0-1016.16, 7.0.0-1017.17
linux-azure-fde (Ubuntu package) - update to 6.8.0-1068.75
linux-azure-fde-6.8 (Ubuntu package) - update to 6.8.0-1068.75~22.04.1
linux-azure-6.8 (Ubuntu package) - update to 6.8.0-1070.78~22.04.1
linux-azure-fips (Ubuntu package) - update to 6.8.0-1069.77+fips1
linux (Ubuntu package) - update to 7.0.0-34.34
linux-realtime (Ubuntu package) - update to 7.0.0-34.34.1
linux-gcp (Ubuntu package) - update to 7.0.0-1013.13
linux-aws (Ubuntu package) - update to 7.0.0-1013.13
linux-oracle (Ubuntu package) - update to 7.0.0-1012.12
linux-raspi (Ubuntu package) - update to 7.0.0-1020.20
linux-nvidia (Ubuntu package) - update to 7.0.0-1025.26
linux-ibm (Ubuntu package) - update to 7.0.0-1014.14
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2022.23
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-34.34~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1013.13~24.04.1
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1012.12~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1014.14
linux-gke (Ubuntu package) - update to 7.0.0-1007.8
linux-aws-7.0 (Ubuntu package) - update to 7.0.0-1013.13~24.04.1
linux-nvidia-7.0 (Ubuntu package) - update to 7.0.0-1024.25~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1

• https://git.kernel.org/stable/c/bc650dd5ce6434286b96e2b26a41af81f679cc7c
• https://git.kernel.org/stable/c/c72a0f09c57f92113df69f9b902d11c9e4b132f5

• Improper locking in Linux kernel net mana
• Ubuntu update for linux-gcp
• Ubuntu update for linux
• Ubuntu update for linux-oracle-7.0
• Ubuntu update for linux-gke
• Ubuntu update for linux-azure-7.0
• Ubuntu update for linux-azure
• Ubuntu update for linux-azure
• Ubuntu update for linux-nvidia-7.0, linux-nvidia-bos
• Ubuntu update for linux-nvidia