CVE-2026-53324
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
36/100
Published: 2026-06-26
Modified: 2026-11-06
First seen: 2026-11-06
Status: active
Attack Surface
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: net: mana: Use pci_name() for debugfs directory naming Use pci_name(pdev) for the per-device debugfs directory instead of hardcoded "0" for PFs and pci_slot_name(pdev->slot) for VFs. The previous approach had two issues: 1. pci_slot_name() dereferences pdev->slot, which can be NULL for VFs in environments like generic VFIO passthrough or nested KVM, causing a NULL pointer dereference. 2. Multiple PFs would all use "0", and VFs across different PCI domains or buses could share the same slot name, leading to -EEXIST errors from debugfs_create_dir(). pci_name(pdev) returns the unique BDF address, is always valid, and is unique across the system.
Weakness Classification (1)
Affected Software (5)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | 6607c17c6c5e029da03a90085db22daf518232bf < 34dbd7b819544c99c9d96b400fe4db613f40ac4b |
| Linux | Linux | 6607c17c6c5e029da03a90085db22daf518232bf < 9211eb97e8f8c28bf9313ab97862d143dbbbef97 |
| Linux | Linux | 6607c17c6c5e029da03a90085db22daf518232bf < c116f07ab9d22bb6f355f3cf9e44c1e6a47fe559 |
| Linux | Linux | 6.13 |
| linux | linux_kernel | 6.13 – 6.18.33 |