What’s Vulnerable › Vulnerabilities

CVE-2026-53324: net: mana: Use pci_name() for debugfs directory naming

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-26 · updated 2026-07-06
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: net: mana: Use pci_name() for debugfs directory naming Use pci_name(pdev) for the per-device debugfs directory instead of hardcoded "0" for PFs and pci_slot_name(pdev->slot) for VFs. The previous approach had two issues: 1. pci_slot_name() dereferences pdev->slot, which can be NULL for VFs in environments like generic VFIO passthrough or nested KVM, causing a NULL pointer dereference. 2. Multiple PFs would all use "0", and VFs across different PCI domains or buses could share the same slot name, leading to -EEXIST errors from debugfs_create_dir(). pci_name(pdev) returns the unique BDF address, is always valid, and is unique across the system.

Affected products

• Linux kernel: from 6.13 before 6.18.33; from 6.19 before 7.0.10 — fixed in 6.18.33, 7.0.10

How to fix

Upgrade to a fixed version: Linux kernel 6.18.33, 7.0.10. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/34dbd7b819544c99c9d96b400fe4db613f40ac4b
• https://git.kernel.org/stable/c/9211eb97e8f8c28bf9313ab97862d143dbbbef97
• https://git.kernel.org/stable/c/c116f07ab9d22bb6f355f3cf9e44c1e6a47fe559

Get alerted when CVE-2026-53324 or the next vulnerability affects your stack