CVE-2026-80620
Description
In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails. When msix_setup_interrupts() fails, the call chain is: msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap: void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } } So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer. This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh: WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ... RDI=0 confirms iounmap() is called with NULL. Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup.
How to fix
- Linux Linux82e120a7dd566c476ba923d30e3fb78e8118a1dd, 6848ca381edff84f87dd1b6973848c271541e813, 0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f, f79519f636059b007d6abc91652f36dea4f54a20, 3691a82be2095abaf3326a1cbf7b25858a1d959c, f64e03da0d83cb173743888bff4a7e61476a8fc2, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 6.20 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 4a7589b615a3db6792d36b874add86cd22188c95 ≤ v < 82e120a7dd566c476ba923d30e3fb78e8118a1dd, 5f007c6acaa7d9a543b492c1e48c48a0ea1d7147 ≤ v < 6848ca381edff84f87dd1b6973848c271541e813, 76f7abd4ee0188f06465bdd3c053fdc5e8595152 ≤ v < 0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f, aee8db5f048616990dbdefcc25689ade0a2620ec ≤ v < f79519f636059b007d6abc91652f36dea4f54a20, 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ≤ v < 3691a82be2095abaf3326a1cbf7b25858a1d959c, 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ≤ v < f64e03da0d83cb173743888bff4a7e61476a8fc2, 19bf27b450fcd5309bacd614b12bd7de1ac6535b, 6.1.165 ≤ v < 6.1.178, 6.6.128 ≤ v < 6.6.145, 6.12.75 ≤ v < 6.12.97, 6.18.16 ≤ v < 6.18.40, 6.19.6 ≤ v < 6.20, 7.0 | 82e120a7dd566c476ba923d30e3fb78e8118a1dd, 6848ca381edff84f87dd1b6973848c271541e813, 0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f, f79519f636059b007d6abc91652f36dea4f54a20, 3691a82be2095abaf3326a1cbf7b25858a1d959c, f64e03da0d83cb173743888bff4a7e61476a8fc2, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 6.20 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.