Review reviewHigh

CVE-2026-53322

Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs before disabling function On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disabled via vfio_pci_core_disable(). This ensures that all access via DMABUFs is revoked before the function's BARs become inaccessible. This fixes an issue where, if the function is disabled first, a tiny window exists in which the function's MSE is cleared and yet BARs could still be accessed via the DMABUF. The resources would also be freed and up for grabs by...

CVSS: 8.8
EPSS: 0.13%
CISA KEV: Not listed
Published: 2026.06.27

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.13%

Technical severityCVSS 8.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6
Affected versions: >= 5d74781ebc86c5fa9e9d6934024c505412de9b52 < 4f1000a30f67cf7d328059242776a858611d5ef9, >= 5d74781ebc86c5fa9e9d6934024c505412de9b52 < d97708701434ce72968e771976aaf9d3438fcafd, >= 6.19, >= 6.19 < 7.0.10
Fixed versions: 7.0.10

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-415, CWE-826