A critical out-of-bounds memory access vulnerability in the Linux kernel mana driver allows an attacker to achieve code execution or system compromise within Confidential VM environments.

This is an out-of-bounds array access vulnerability located in the mana_hwc_rx_event_handler function of the mana driver. The flaw stems from insufficient validation of the rx_req_idx parameter, which allows hardware to trigger an out-of-bounds write or read in Confidential VM (SEV-SNP/TDX) environments where memory is shared unencrypted.

The vulnerability carries a CVSS score of 9.3, classifying it as critical due to the potential for full system compromise, including confidentiality, integrity, and availability loss. In Confidential VM environments, this flaw could allow an attacker to bypass security boundaries, potentially leading to unauthorized data access or complete control over the host or guest system.

Immediate Action: Update the Linux kernel to version 5.15.209, 6.1.175, 6.6.142, 6.12.92, or a later stable release provided by the distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected hardware-related error messages associated with the mana network driver.

Compensating Controls: Restrict access to Confidential VM instances and ensure that kernel hardening features are enabled to mitigate the impact of memory corruption vulnerabilities.

Public Exploit Available: Unknown.

Given the critical severity and the potential for system-wide compromise in virtualized environments, administrators must prioritize patching the Linux kernel across all affected infrastructure. Apply the verified kernel updates immediately to eliminate the out-of-bounds access vector and prevent unauthorized escalation within Confidential VM deployments.