CVE-2026-53324

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
26/06/2026
Last modified:
06/07/2026

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: mana: Use pci_name() for debugfs directory naming<br /> <br /> Use pci_name(pdev) for the per-device debugfs directory instead of<br /> hardcoded "0" for PFs and pci_slot_name(pdev-&gt;slot) for VFs. The<br /> previous approach had two issues:<br /> <br /> 1. pci_slot_name() dereferences pdev-&gt;slot, which can be NULL for VFs<br /> in environments like generic VFIO passthrough or nested KVM,<br /> causing a NULL pointer dereference.<br /> <br /> 2. Multiple PFs would all use "0", and VFs across different PCI<br /> domains or buses could share the same slot name, leading to<br /> -EEXIST errors from debugfs_create_dir().<br /> <br /> pci_name(pdev) returns the unique BDF address, is always valid, and is<br /> unique across the system.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.13 (including) 6.18.33 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.19 (including) 7.0.10 (excluding)