Vulnerability in Linux Kernel Affecting VFIO PCI Functionality

CVE-2026-53322

What is CVE-2026-53322?

A vulnerability in the Linux kernel related to the VFIO PCI subsystem may pose risks during device shutdown processes. Specifically, when a device is shutting down, the function responsible for disabling it fails to properly clean up DMABUFs before the function is disabled. This oversight creates a brief window where access to the function's Memory Space Elements (MSE) is revoked but its Base Address Registers (BARs) may still be accessible through DMABUFs. Consequently, this could allow resources to be freed and potentially misused by other drivers, leading to unintended behavior or security challenges.

References