The Linux kernel vulnerability involves the vfio/pci driver not properly cleaning up DMA buffers before disabling a PCI function on device shutdown. Specifically, the fix ensures that vfio_pci_core_close_device() calls vfio_pci_dma_buf_cleanup() before vfio_pci_core_disable() is invoked. Without this fix, a small window exists where the function's Memory Space Enable (MSE) bit is cleared, but BARs (Base Address Registers) remain accessible via DMABUFs, allowing potential unauthorized access to device memory that should have been freed. This vulnerability affects Linux kernel versions prior to 7.0.0-28.28.1 and multiple Ubuntu LTS distributions.

Successful exploitation could allow local attackers with limited privileges to access or manipulate device memory after the device function is disabled, potentially leading to confidentiality, integrity, and availability impacts on the system. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

A fix is available in Linux kernel version 7.0.0-28.28.1 and later. Users should update to this or a later kernel version to remediate the vulnerability. Since this is a kernel-level issue, applying the official kernel update from the vendor is the recommended mitigation. No additional vendor advisory content is provided, so check the Ubuntu security advisories for the corresponding kernel updates for each affected LTS version.