In the Linux kernel, the following vulnerability has been resolved:

net: mana: validate rx_req_idx to prevent out-of-bounds array access

In mana_hwc_rx_event_handler(), rx_req_idx is derived from
sge->address in DMA-coherent memory. In Confidential VMs
(SEV-SNP/TDX), this memory is shared unencrypted and HW can modify
WQE contents at any time. No bounds check exists on rx_req_idx,
which can lead to an out-of-bounds access into reqs[].

Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before
using it to index the reqs[] array.

https://git.kernel.org/stable/c/01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01

https://git.kernel.org/stable/c/355e9f2b2a7887ca38100127989af3e422ba71d0

https://git.kernel.org/stable/c/5ddc715324badd7f2641bc177db1d027b402adae

https://git.kernel.org/stable/c/763a372d344fb12fae566d36ddb46e92454ad58c

https://git.kernel.org/stable/c/b809d0409991b75a6cff846a5ac27c3062953f84

https://git.kernel.org/stable/c/fa627a5eaa83fc0261f44ef3769693b886ca6e27

https://git.kernel.org/stable/c/ff1d5af207bcea857d45fe81505f1bc4b29eaef0

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/microsoft/mana/hw_channel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f","lessThan":"5ddc715324badd7f2641bc177db1d027b402adae","versionType":"git","status":"affected"},{"version":"ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f","lessThan":"ff1d5af207bcea857d45fe81505f1bc4b29eaef0","versionType":"git","status":"affected"},{"version":"ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f","lessThan":"01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01","versionType":"git","status":"affected"},{"version":"ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f","lessThan":"763a372d344fb12fae566d36ddb46e92454ad58c","versionType":"git","status":"affected"},{"version":"ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f","lessThan":"fa627a5eaa83fc0261f44ef3769693b886ca6e27","versionType":"git","status":"affected"},{"version":"ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f","lessThan":"355e9f2b2a7887ca38100127989af3e422ba71d0","versionType":"git","status":"affected"},{"version":"ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f","lessThan":"b809d0409991b75a6cff846a5ac27c3062953f84","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/microsoft/mana/hw_channel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.142","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]