Improper control of a resource through its lifetime in Linux kernel - CVE-2026-53322

Detailed vulnerability description

The vulnerability allows a local user to access device BAR resources after device shutdown, potentially leading to disclosure of sensitive information, modification of data, or a denial of service.

The vulnerability exists due to improper resource shutdown sequencing in vfio_pci_core_close_device() when closing a device while DMABUF access remains active. A local user can keep accessing the device through DMABUF mappings during the shutdown window to access device BAR resources after device shutdown, potentially leading to disclosure of sensitive information, modification of data, or a denial of service.

The issue occurs in a small window after memory space enable is cleared and before DMABUF access is revoked, while the resources may be reassigned to a different driver.

How to mitigate CVE-2026-53322

Sources

• https://git.kernel.org/stable/c/4f1000a30f67cf7d328059242776a858611d5ef9
• https://git.kernel.org/stable/c/d97708701434ce72968e771976aaf9d3438fcafd