CVE-2026-53324
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk5th percentile — higher than 5% of all known CVEs
Summary
In the Linux kernel, the MANA network driver (Microsoft Azure Network Adapter) had a vulnerability due to incorrect debugfs directory naming. The previous approach used a hardcoded "0" for Physical Functions (PFs) and pci_slot_name() for Virtual Functions (VFs), leading to race conditions and potential memory leaks. The fix replaces these with the unique BDF identifier returned by pci_name().
Risk Assessment
The risk for the organization includes potential system crashes (kernel panic) in virtualized environments (VFIO passthrough, nested KVM) and issues with managing MANA network devices, which could lead to network service disruptions.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit addressing the issue). Monitor environments using MANA network adapters in virtualized configurations.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: mana: Use pci_name() for debugfs directory naming Use pci_name(pdev) for the per-device debugfs directory instead of hardcoded "0" for PFs and pci_slot_name(pdev->slot) for VFs. The previous approach had two issues: 1. pci_slot_name() dereferences pdev->slot, which can be NULL for VFs in environments like generic VFIO passthrough or nested KVM, causing a NULL pointer dereference. 2. Multiple PFs would all use "0", and VFs across different PCI domains or buses could share the same slot name, leading to -EEXIST errors from debugfs_create_dir(). pci_name(pdev) returns the unique BDF address, is always valid, and is unique across the system.