The Linux kernel vulnerability CVE-2026-53324 affected the MANA driver where debugfs directories were named using pci_slot_name(pdev->slot) for virtual functions (VFs) and a hardcoded "0" for physical functions (PFs). This approach caused two problems: pci_slot_name() could dereference a NULL pointer if pdev->slot was NULL in certain environments (e.g., VFIO passthrough or nested KVM), leading to a NULL pointer dereference; and multiple PFs and VFs could share the same directory name, causing -EEXIST errors from debugfs_create_dir(). The fix replaced these with pci_name(pdev), which returns a unique, always valid BDF address, preventing these issues. This vulnerability has a CVSS 3.1 score of 5.5 (medium severity) with local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact.

An attacker with local access and low privileges could cause a NULL pointer dereference in the kernel, potentially leading to denial of service by crashing the system. There is no impact on confidentiality or integrity. The vulnerability does not escalate privileges or allow code execution but affects system availability.

A patch is available and should be applied by updating the Linux kernel to version 7.0.0-28.28 or later as provided by the vendor. After updating, a system reboot is required. No additional mitigation is necessary as the issue is fixed in these versions.