The Linux kernel vulnerability CVE-2026-53322 involves the vfio/pci subsystem where the function vfio_pci_core_close_device() did not call vfio_pci_dma_buf_cleanup() before disabling the function via vfio_pci_core_disable(). This sequencing flaw allowed a small window during device shutdown where the function's Memory Space Enable (MSE) bit was cleared but the device's Base Address Registers (BARs) were still accessible through DMA buffers (DMABUFs). This could lead to unauthorized access to device memory that should have been revoked, with potential resource conflicts if other drivers accessed the freed resources. The vulnerability affects Linux kernel versions prior to 7.0.0-28.28~24.04.1 and related builds. Ubuntu has released patches in kernel updates that fix this issue by correcting the cleanup order.

If exploited, this vulnerability could allow a local attacker with limited privileges to access device memory regions after device shutdown, potentially leading to privilege escalation or corruption of system state. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability. However, exploitation requires local access and low complexity. No known exploits are reported in the wild at this time.

A patch is available and has been released by Ubuntu in multiple Linux kernel packages. Users should update to the fixed kernel versions listed in the Ubuntu advisories (e.g., linux-image-7.0.0-28.28 and later). After updating, a system reboot is required to apply the fix. Due to an ABI change, recompilation and reinstallation of all third-party kernel modules is necessary. No additional mitigation steps are required beyond applying the official updates.