CVE-2026-53324
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
26/06/2026
Last modified:
06/07/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
net: mana: Use pci_name() for debugfs directory naming<br />
<br />
Use pci_name(pdev) for the per-device debugfs directory instead of<br />
hardcoded "0" for PFs and pci_slot_name(pdev->slot) for VFs. The<br />
previous approach had two issues:<br />
<br />
1. pci_slot_name() dereferences pdev->slot, which can be NULL for VFs<br />
in environments like generic VFIO passthrough or nested KVM,<br />
causing a NULL pointer dereference.<br />
<br />
2. Multiple PFs would all use "0", and VFs across different PCI<br />
domains or buses could share the same slot name, leading to<br />
-EEXIST errors from debugfs_create_dir().<br />
<br />
pci_name(pdev) returns the unique BDF address, is always valid, and is<br />
unique across the system.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.18.33 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.19 (including) | 7.0.10 (excluding) |
To consult the complete list of CPE names with products and versions, see this page



