Skip to main content

Linux Kernel CVE-2026-72064

| EUVDEUVD-2026-59022 CRITICAL
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-fh7x-649r-3p95
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
3.0 LOW

Not attacker-triggered remotely; needs local MANA host with non-default swiotlb=force (AV:L/AC:H/PR:H), yielding stale-memory disclosure and RX breakage (C:L/A:L).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 17, 2026 - 06:36 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
CVE Published
Aug 15, 2026 - 06:21 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Sync page pool RX frags for CPU

MANA allocates RX buffers from page pool fragments when frag_count is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call dma_unmap_single(). As a result, the implicit sync-for-CPU normally performed by dma_unmap_single() is missing before the packet data is passed to the networking stack.

This breaks RX on configurations which require explicit DMA syncing, for example when booted with swiotlb=force.

Fix this by recording the page pool page and DMA sync offset when the RX buffer is allocated, and syncing the received packet range for CPU access before handing the RX buffer to the stack.

AnalysisAI

Missing DMA sync-for-CPU in the Linux kernel's MANA (Microsoft Azure Network Adapter) RX path can hand stale or uninitialized buffer memory to the networking stack on systems that require explicit DMA syncing, such as those booted with swiotlb=force. The flaw affects the mana Ethernet driver when RX buffers come from page-pool fragments (frag_count > 1), where the DMA unmap that normally performs the implicit CPU sync is skipped. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and it is not listed in CISA KEV.

Technical ContextAI

The affected code is the MANA driver (drivers/net/ethernet/microsoft/mana), the Linux network driver for the Microsoft Azure Network Adapter used by Azure VMs. MANA can allocate RX buffers as page-pool fragments; when frag_count is greater than 1, the buffers stay DMA-mapped by the page pool and the completion path never calls dma_unmap_single(). On architectures/configurations with a non-coherent or bounce-buffer DMA path (e.g., swiotlb=force), dma_unmap_single() is what normally performs the sync-for-CPU that copies device-written data from the bounce buffer into the CPU-visible page. Without it, the CPU reads stale page contents. The upstream fix records the page-pool page and DMA sync offset at allocation and calls the sync-for-CPU on the received range before passing the skb up. No CWE was assigned; the root-cause class is best described as improper DMA cache/buffer synchronization leading to use of stale memory (functionally a missing-synchronization / uninitialized-data-read defect).

RemediationAI

Upstream fix available (commits bc650dd5ce6434286b96e2b26a41af81f679cc7c and c72a0f09c57f92113df69f9b902d11c9e4b132f5); apply the stable kernel update that includes these MANA changes for your distribution/branch, verifying the exact packaged version with your distro or Azure-tuned kernel vendor rather than relying on the EUVD 'patch' strings. As a targeted compensating control before patching, avoid booting affected MANA hosts with swiotlb=force (or otherwise forcing bounce-buffer DMA) where policy permits, since the bug only manifests on the explicit-sync DMA path - note the trade-off that swiotlb=force is often set intentionally for confidential-computing/hardware-isolation reasons, so disabling it may be unacceptable in those deployments and is not a substitute for the fix. There is no attacker-facing endpoint to block; the primary and correct remediation is the kernel update. Track the fix via the kernel.org commit links above and the NVD entry.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72064 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy