CVE-2026-64018
A critical flaw in the Linux kernel’s mana driver allows an attacker to cause an out‑of‑bounds array access by manipulating a DMA‑coherent memory value. The bug can corrupt kernel memory and potentially compromise the system. The issue has been fixed in the kernel.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, specifically the mana driver used in Confidential VMs such as SEV‑SNP or TDX. System administrators running these VMs are the typical users.
Real-world impact
An attacker could corrupt kernel memory, leading to privilege escalation, data tampering, or denial of service.
Why this severity
The CVSS score of 9.3 reflects local access with no privileges, no user interaction, and full compromise of confidentiality, integrity, and availability.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for CVE-2026-64018.
NVD description
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/01f7f893d5e1baae99…
- git.kernel.org/stable/c/355e9f2b2a7887ca38…
- git.kernel.org/stable/c/5ddc715324badd7f26…
- git.kernel.org/stable/c/763a372d344fb12fae…
- git.kernel.org/stable/c/b809d0409991b75a6c…
- git.kernel.org/stable/c/fa627a5eaa83fc0261…
- git.kernel.org/stable/c/ff1d5af207bcea857d…