CVE-2026-53324: net: mana: Use pci_name() for debugfs directory naming
In the Linux kernel, the following vulnerability has been resolved:
net: mana: Use pciname() for debugfs directory naming
Use pciname(pdev) for the per-device debugfs directory instead of hardcoded "0" for PFs and pcislotname(pdev->slot) for VFs. The previous approach had two issues:
1. pcislotname() dereferences pdev->slot, which can be NULL for VFs in environments like generic VFIO passthrough or nested KVM, causing a NULL pointer dereference.
2. Multiple PFs would all use "0", and VFs across different PCI domains or buses could share the same slot name, leading to -EEXIST errors from debugfscreatedir().
pciname(pdev) returns the unique BDF address, is always valid, and is unique across the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the net:mana kernel code to name the per-device debugfs directory using pci_name(pdev) (unique BDF, always valid) rather than hardcoded "0" for PFs or pci_slot_name(pdev->slot) for VFs to avoid NULL pointer dereference.
Linux kernel debugfs directory naming for net: mana (debugfs_create_dir) = Use pci_name(pdev) instead of hardcoded "0"/pci_slot_name(pdev->slot)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53324?
CVE-2026-53324 has a medium severity rating of 5.5 according to the CVSS 3.1 score.
How do I fix CVE-2026-53324?
To fix CVE-2026-53324, update your Linux kernel to include the patches addressing the debugfs directory naming issue.
What type of vulnerability is CVE-2026-53324?
CVE-2026-53324 is classified as a Null Pointer Dereference vulnerability.
When was CVE-2026-53324 published?
CVE-2026-53324 was published on June 26, 2026.
What software is affected by CVE-2026-53324?
CVE-2026-53324 affects the Linux kernel.