Skip to content
Fencer Vulns
high 8.8

CVE-2026-53322 json

vfio/pci: Clean up DMABUFs before disabling function

published 2026-06-26 4 mo ago modified 2026-09-09 1 mo ago also EUVD-2026-39857

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Clean up DMABUFs before disabling function

On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disabled via vfio_pci_core_disable(). This ensures that all access via DMABUFs is revoked before the function's BARs become inaccessible.

This fixes an issue where, if the function is disabled first, a tiny window exists in which the function's MSE is cleared and yet BARs could still be accessed via the DMABUF. The resources would also be freed and up for grabs by a different driver.

Patch / fix

  • Linux Linux 7.0.10, 7.1
  • Red Hat Red Hat Enterprise Linux 10 0:6.12.0-211.53.1.el10_2
  • linux Debian 14 7.0.10-1

debian advisories DEBIAN-CVE-2026-53322

  • linux Ubuntu 26.04 LTS 7.0.0-28.28
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1009.9
  • linux-gcp Ubuntu 26.04 LTS 7.0.0-1008.8
  • linux-gke Ubuntu 26.04 LTS 7.0.0-1003.4
  • linux-ibm Ubuntu 26.04 LTS 7.0.0-1010.10
  • linux-azure Ubuntu 26.04 LTS 7.0.0-1010.10
  • linux-raspi Ubuntu 26.04 LTS 7.0.0-1015.15
  • linux-riscv Ubuntu 26.04 LTS 7.0.0-28.28.1

ubuntu advisories UBUNTU-CVE-2026-53322

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 10.2 6.12.0-211.53.1.el10_2
  • rv RHEL 10.2 6.12.0-211.53.1.el10_2
  • perf RHEL 10.2 6.12.0-211.53.1.el10_2
  • rtla RHEL 10.2 6.12.0-211.53.1.el10_2
  • libperf RHEL 10.2 6.12.0-211.53.1.el10_2
  • kernel-rt RHEL 10.2 6.12.0-211.53.1.el10_2
  • kernel-64k RHEL 10.2 6.12.0-211.53.1.el10_2
  • kernel-core RHEL 10.2 6.12.0-211.53.1.el10_2

red hat advisories RHSA-2026:65334

  • kernel AlmaLinux 10 6.12.0-211.53.1.el10_2
  • rv AlmaLinux 10 6.12.0-211.53.1.el10_2
  • perf AlmaLinux 10 6.12.0-211.53.1.el10_2
  • rtla AlmaLinux 10 6.12.0-211.53.1.el10_2
  • libperf AlmaLinux 10 6.12.0-211.53.1.el10_2
  • kernel-rt AlmaLinux 10 6.12.0-211.53.1.el10_2
  • kernel-64k AlmaLinux 10 6.12.0-211.53.1.el10_2
  • kernel-core AlmaLinux 10 6.12.0-211.53.1.el10_2

almalinux advisories ALSA-2026:65334

  • kernel Rocky Linux 10 6.12.0-211.53.1.el10_2

rocky linux advisories RLSA-2026:65334

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-53322 updated cvss 7.0

kernel: vfio/pci: Clean up DMABUFs before disabling function

  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.53.1.el10_2, perf 6.12.0-211.53.1.el10_2, rtla 6.12.0-211.53.1.el10_2, python3-perf 6.12.0-211.53.1.el10_2, kernel-devel-matched 6.12.0-211.53.1.el10_2, kernel-64k-devel-matched 6.12.0-211.53.1.el10_2, +7 more Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.53.1.el10_2, kernel-64k 6.12.0-211.53.1.el10_2, kernel-core 6.12.0-211.53.1.el10_2, kernel-tools 6.12.0-211.53.1.el10_2, kernel-modules 6.12.0-211.53.1.el10_2, kernel-64k-core 6.12.0-211.53.1.el10_2, +28 more Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.53.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.53.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.53.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.53.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.53.1.el10_2 Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.53.1.el10_2, kernel-rt-64k 6.12.0-211.53.1.el10_2, kernel-rt-core 6.12.0-211.53.1.el10_2, kernel-rt-modules 6.12.0-211.53.1.el10_2, kernel-rt-64k-core 6.12.0-211.53.1.el10_2, kernel-rt-debug-core 6.12.0-211.53.1.el10_2, +14 more Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.53.1.el10_2, kernel-rt-core 6.12.0-211.53.1.el10_2, kernel-rt-modules 6.12.0-211.53.1.el10_2, kernel-rt-debug-core 6.12.0-211.53.1.el10_2, kernel-rt-modules-core 6.12.0-211.53.1.el10_2, kernel-rt-debug-modules 6.12.0-211.53.1.el10_2, +4 more
    fixed: vendor fix RHSA-2026:65334
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADP 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-826 Premature Release of Resource During Expected Lifetime
  • CWE-415 Double Free
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.