Skip to main content

Linux Kernel CVE-2026-53322

| EUVDEUVD-2026-39857 HIGH
Premature Release of Resource During Expected Lifetime (CWE-826)
2026-06-26 Linux GHSA-rj34-crxv-j5mg
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local VFIO device access needed (AV:L/PR:L); a 'tiny window' shutdown race makes it AC:H; resources pass to another driver so S:C, with high info-leak and corruption impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:55 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 26, 2026 - 19:41 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Clean up DMABUFs before disabling function

On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disabled via vfio_pci_core_disable(). This ensures that all access via DMABUFs is revoked before the function's BARs become inaccessible.

This fixes an issue where, if the function is disabled first, a tiny window exists in which the function's MSE is cleared and yet BARs could still be accessed via the DMABUF. The resources would also be freed and up for grabs by a different driver.

AnalysisAI

Resource access-after-free in the Linux kernel's vfio/pci subsystem allows a local user with device access to read or corrupt PCI device resources during a race window on device shutdown, because vfio_pci_core_close_device() disabled the function before tearing down DMABUF exports. During the window the function's Memory Space Enable bit is cleared and its BARs (and their backing resources) are freed and reassignable to another driver, while stale DMABUF mappings still reference them. EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis; the upstream fix reorders cleanup to revoke DMABUF access first.

Technical ContextAI

The affected component is VFIO (Virtual Function I/O) PCI passthrough, the kernel framework that hands physical PCI/PCIe functions to userspace or to guest VMs (commonly via QEMU/KVM). VFIO can export a device's MMIO BAR regions as DMABUF file descriptors so other drivers or peers can DMA to/from device memory. The root cause is an ordering/lifetime bug (a CWE-362 race-condition / CWE-416 use-after-free class issue; CWE was not assigned in the input): on close, vfio_pci_core_disable() ran before vfio_pci_dma_buf_cleanup(), so the function's BARs were made inaccessible and their resources released while DMABUF references to those regions still existed. The CPE data identifies the product generically as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel, with the fix landing in the 6.19 development cycle and stable backports.

RemediationAI

Patch available per vendor advisory: upgrade to a Linux kernel containing the fix commits 4f1000a30f67cf7d328059242776a858611d5ef9 and d97708701434ce72968e771976aaf9d3438fcafd (merged in the 6.19 cycle and backported to stable trees), which reorder vfio_pci_core_close_device() to call vfio_pci_dma_buf_cleanup() before vfio_pci_core_disable(); a released, tagged stable version number is not independently confirmed from the input, so apply your distribution's kernel update that references this CVE. If immediate patching is not possible, the most effective compensating control is to restrict who can use VFIO device passthrough: limit membership/access to /dev/vfio and the device group so only trusted virtualization tooling (e.g. libvirt/QEMU) can bind devices, and avoid exposing VFIO DMABUF export to untrusted local users or guests - the trade-off is reduced flexibility for userspace driver/passthrough workloads. Apply via your kernel vendor's advisory and the kernel.org stable commits listed above.

Same weakness CWE-826 – Premature Release of Resource During Expected Lifetime

View all
CVE-2026-49427 HIGH
8.8
CVE-2026-31663 HIGH
7.8
CVE-2023-1297 HIGH
7.5
CVE-2024-51727 HIGH
7.1
CVE-2024-58249 LOW
3.7
CVE-2025-24912 LOW
3.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53322 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy