CVE-2026-80620Revert "PCI/MSI: Unmap MSI-X region on error"
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails. When msix_setup_interrupts() fails, the call chain is: msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap: void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } } So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer. This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh: WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ... RDI=0 confirms iounmap() is called with NULL. Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 28, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4a7589b615a3db6792d36b874add86cd22188c95 before 82e120a7dd566c476ba923d30e3fb78e8118a1dd; from 5f007c6acaa7d9a543b492c1e48c48a0ea1d7147 before 6848ca381edff84f87dd1b6973848c271541e813; 76f7abd4ee0188f06465bdd3c053fdc5e8595152 builds before 0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f; from aee8db5f048616990dbdefcc25689ade0a2620ec before f79519f636059b007d6abc91652f36dea4f54a20; from 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 before 3691a82be2095abaf3326a1cbf7b25858a1d959c; from 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 before f64e03da0d83cb173743888bff4a7e61476a8fc2; 19bf27b450fcd5309bacd614b12bd7de1ac6535b; from 6.1.165 before 6.1.178; and 4 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/82e120a7dd566c476ba923d30e3fb78e8118a1dd
- https://git.kernel.org/stable/c/6848ca381edff84f87dd1b6973848c271541e813
- https://git.kernel.org/stable/c/0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f
- https://git.kernel.org/stable/c/f79519f636059b007d6abc91652f36dea4f54a20
- https://git.kernel.org/stable/c/3691a82be2095abaf3326a1cbf7b25858a1d959c
- https://git.kernel.org/stable/c/f64e03da0d83cb173743888bff4a7e61476a8fc2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.