Skip to main content

Linux Kernel CVE-2026-53324

| EUVDEUVD-2026-39859 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-26 Linux GHSA-78w3-3c52-99hr
Linux Denial Of Service Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local trigger via VF initialization requires low OS privilege; only availability impact (kernel panic); no confidentiality or integrity exposure; conditions are non-default but mechanistically simple.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 20:51 vuln.today
CVSS changed
Jul 06, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 26, 2026 - 19:41 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Use pci_name() for debugfs directory naming

Use pci_name(pdev) for the per-device debugfs directory instead of hardcoded "0" for PFs and pci_slot_name(pdev->slot) for VFs. The previous approach had two issues:

  1. pci_slot_name() dereferences pdev->slot, which can be NULL for VFs

in environments like generic VFIO passthrough or nested KVM, causing a NULL pointer dereference.

  1. Multiple PFs would all use "0", and VFs across different PCI

domains or buses could share the same slot name, leading to -EEXIST errors from debugfs_create_dir().

pci_name(pdev) returns the unique BDF address, is always valid, and is unique across the system.

AnalysisAI

NULL pointer dereference in the Linux kernel MANA (Microsoft Azure Network Adapter) driver crashes the host kernel when initializing Virtual Function (VF) devices in VFIO passthrough or nested KVM environments where pdev->slot is unpopulated. Systems running affected kernel versions in Azure-style or nested virtualization deployments face deterministic kernel panics and total availability loss on the host. No public exploit code has been identified, and EPSS probability is 0.16% (5th percentile), indicating low opportunistic exploitation risk - though in targeted Azure or nested KVM environments, the crash is straightforwardly reproducible.

Technical ContextAI

The vulnerability (CWE-476: NULL Pointer Dereference) resides in the net/mana subsystem of the Linux kernel, which implements the Microsoft Azure Network Adapter driver used in Azure VMs and Hyper-V guests. The flawed code attempted to name per-device debugfs directories using pci_slot_name(pdev->slot) for VFs and hardcoded '0' for PFs. In generic VFIO passthrough and nested KVM environments, the kernel does not populate pdev->slot for VFs - leaving it NULL - because these hypervisor stacks do not model PCI slot metadata for passthrough devices. Calling pci_slot_name() on a NULL pdev->slot causes an immediate kernel NULL dereference. The secondary issue - hardcoding '0' for all PFs - produced -EEXIST errors from debugfs_create_dir() in multi-PF environments. The fix replaces both approaches with pci_name(pdev), which returns the unique BDF (Bus:Device.Function) address, is always valid, and is globally unique. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Apply the upstream stable-kernel patches: the fix commits 34dbd7b819544c99c9d96b400fe4db613f40ac4b, 9211eb97e8f8c28bf9313ab97862d143dbbbef97, and c116f07ab9d22bb6f355f3cf9e44c1e6a47fe559 are available at git.kernel.org. Distribution-specific updates incorporating this fix target Linux 6.18.33, 7.0.10, and 7.1 as confirmed by EUVD data. For systems where patching is not immediately possible, disabling MANA VF device passthrough in VFIO or nested KVM configurations prevents triggering the NULL dereference; the trade-off is loss of MANA VF-based networking for guest workloads reliant on that path. Alternatively, blacklisting the MANA driver (mana) in environments that do not require Azure-specific networking avoids exposure entirely, with the trade-off of losing Azure network accelerated networking support. No workaround eliminates the risk if MANA VF passthrough is a required workload dependency - patching is the only complete fix.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53324 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy