In the Linux kernel, the following vulnerability has been resolved:
net: mana: Sync page pool RX frags for CPU
MANA allocates RX buffers from page pool fragments when frag_count is
greater than 1. In that case the buffers remain DMA mapped by page pool
and the RX completion path does not call dma_unmap_single(). As a result,
the implicit sync-for-CPU normally performed by dma_unmap_single() is
missing before the packet data is passed to the networking stack.
This breaks RX on configurations which require explicit DMA syncing, for
example when booted with swiotlb=force.
Fix this by recording the page pool page and DMA sync offset when the RX
buffer is allocated, and syncing the received packet range for CPU access
before handing the RX buffer to the stack.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The bug is in the MANA Ethernet RX completion path (MSI-X/NAPI → mana_process_rx_cqe → mana_refill_rx_oob → mana_rx_skb) on Azure/cloud VMs; any remote host that can send IP traffic to the MANA interface drives packet reception before authentication or local privilege checks.
AC:L - On deployments where DMA needs explicit CPU sync (e.g. swiotlb=force or non-coherent DMA), every received frame on the default standard-MTU page-pool-fragment path (frag_count>1) deterministically skips sync; the attacker only sends network packets with no race, layout gamble, or timing window.
PR:N - Exploitation requires no credentials or local access; the vulnerable code runs in hardware interrupt/NAPI context on inbound packets and is not gated by capabilities, netlink, ioctl, or user namespaces.
UI:N - Packet reception and handoff to the networking stack occur automatically once the MANA interface is up; no victim mount, click, or other administrative action is required beyond normal network operation.
S:U - Impact is confined to incorrect/stale packet data processed inside the same guest kernel and network stack; it does not cross a VM-host, IOMMU, or other separate security boundary.
C:H - Without dma_sync_for_cpu the CPU can read stale cache or bounce-buffer contents for the full received length (up to MTU) instead of hardware-written data, disclosing prior RX buffer or unrelated DMA residue to the stack, XDP, or applications.
I:H - The skb handed upward can contain bytes that differ from the frame the NIC actually wrote, corrupting protocol parsing and application-visible payload integrity across the entire packet, not just a bounded tail region.
A:H - On configurations requiring explicit DMA syncing the driver commit reports RX is broken entirely; a remote sender can repeatedly trigger the faulty path and deny reliable receive on the MANA interface.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The bug is in the MANA Ethernet RX completion path (MSI-X/NAPI → mana_process_rx_cqe → mana_refill_rx_oob → mana_rx_skb) on Azure/cloud VMs; any remote host that can send IP traffic to the MANA interface drives packet reception before authentication or local privilege checks.
AC:L - On deployments where DMA needs explicit CPU sync (e.g. swiotlb=force or non-coherent DMA), every received frame on the default standard-MTU page-pool-fragment path (frag_count>1) deterministically skips sync; the attacker only sends network packets with no race, layout gamble, or timing window.
PR:N - Exploitation requires no credentials or local access; the vulnerable code runs in hardware interrupt/NAPI context on inbound packets and is not gated by capabilities, netlink, ioctl, or user namespaces.
UI:N - Packet reception and handoff to the networking stack occur automatically once the MANA interface is up; no victim mount, click, or other administrative action is required beyond normal network operation.
S:U - Impact is confined to incorrect/stale packet data processed inside the same guest kernel and network stack; it does not cross a VM-host, IOMMU, or other separate security boundary.
C:H - Without dma_sync_for_cpu the CPU can read stale cache or bounce-buffer contents for the full received length (up to MTU) instead of hardware-written data, disclosing prior RX buffer or unrelated DMA residue to the stack, XDP, or applications.
I:H - The skb handed upward can contain bytes that differ from the frame the NIC actually wrote, corrupting protocol parsing and application-visible payload integrity across the entire packet, not just a bounded tail region.
A:H - On configurations requiring explicit DMA syncing the driver commit reports RX is broken entirely; a remote sender can repeatedly trigger the faulty path and deny reliable receive on the MANA interface.
CVSS 3.1