Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-15T00:00:00 kernel: net: mana: Validate the packet length reported by the NIC 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-125

In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted.

A flaw was found in the Linux kernel's mana network driver. This vulnerability arises from the driver's failure to validate the packet length reported by the Network Interface Card (NIC) within the Receive Completion Queue Entry (RX CQE) before further processing. A malicious NIC, or an attacker controlling one, could exploit this by providing an intentionally malformed packet length that is larger than the actual received data. This can lead to out-of-bounds reads when processing network packets, potentially causing a kernel crash and a denial of service (DoS).

Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Affected kernel Red Hat Enterprise Linux 8 Affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-72065 https://nvd.nist.gov/vuln/detail/CVE-2026-72065 https://lore.kernel.org/linux-cve-announce/2026081518-CVE-2026-72065-2434@gregkh/T