CVE-2026-53322

A flaw was found in the Linux kernel's vfio/pci subsystem. During device shutdown, an improper order of operations in cleaning up Direct Memory Access Buffers (DMABUFs) before disabling the function creates a brief window. In this window, a device's Base Address Registers (BARs) could still be accessed via DMABUFs even after memory space enable (MSE) is cleared. This could potentially allow a different driver to access freed resources, leading to information disclosure or unauthorized resource access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, if PCI device passthrough is not required, the vfio_pci kernel module can be blacklisted to prevent it from loading. This can be achieved by creating a file such as /etc/modprobe.d/blacklist-vfio-pci.conf with the content blacklist vfio_pci. A system reboot is required for this change to take effect. Disabling this module may impact functionality that relies on PCI device passthrough.