Linux Kernel EUVD-2026-45591

Update to a kernel that adds the rx_req_idx bounds check in mana_hwc_rx_event_handler(): Vendor-released patch versions are 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11 and mainline 7.1 - apply the fixed build for your distribution's series via your distro's kernel update channel. The corresponding upstream commits are published on git.kernel.org (e.g. https://git.kernel.org/stable/c/5ddc715324badd7f2641bc177db1d027b402adae, https://git.kernel.org/stable/c/fa627a5eaa83fc0261f44ef3769693b886ca6e27 and the other stable backports listed in the references). Since the issue only matters under the confidential-computing threat model, an interim compensating control is to run affected workloads as standard (non-Confidential) VMs where the host is already in the trust boundary, or to avoid the MANA-backed CoCo configuration until patched - the trade-off is losing memory-encryption/attestation guarantees, so this should be a short-term measure only. There is no relevant in-guest configuration toggle to disable, as the exposure is inherent to the mana receive path.