Revert "PCI/MSI: Unmap MSI-X region on error"
Summary
| CVE | CVE-2026-80620 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-28 08:16:46 UTC |
| Updated | 2026-08-28 08:16:46 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails. When msix_setup_interrupts() fails, the call chain is: msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap: void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } } So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer. This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh: WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ... RDI=0 confirms iounmap() is called with NULL. Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup. |
Risk And Classification
EPSS: 0.001720000 probability, percentile 0.067790000 (date 2026-08-30)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 4a7589b615a3db6792d36b874add86cd22188c95 82e120a7dd566c476ba923d30e3fb78e8118a1dd git | Not specified |
| CNA | Linux | Linux | affected 5f007c6acaa7d9a543b492c1e48c48a0ea1d7147 6848ca381edff84f87dd1b6973848c271541e813 git | Not specified |
| CNA | Linux | Linux | affected 76f7abd4ee0188f06465bdd3c053fdc5e8595152 0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f git | Not specified |
| CNA | Linux | Linux | affected aee8db5f048616990dbdefcc25689ade0a2620ec f79519f636059b007d6abc91652f36dea4f54a20 git | Not specified |
| CNA | Linux | Linux | affected 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 3691a82be2095abaf3326a1cbf7b25858a1d959c git | Not specified |
| CNA | Linux | Linux | affected 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 f64e03da0d83cb173743888bff4a7e61476a8fc2 git | Not specified |
| CNA | Linux | Linux | affected 19bf27b450fcd5309bacd614b12bd7de1ac6535b git | Not specified |
| CNA | Linux | Linux | affected 6.1.165 6.1.178 semver | Not specified |
| CNA | Linux | Linux | affected 6.6.128 6.6.145 semver | Not specified |
| CNA | Linux | Linux | affected 6.12.75 6.12.97 semver | Not specified |
| CNA | Linux | Linux | affected 6.18.16 6.18.40 semver | Not specified |
| CNA | Linux | Linux | affected 6.19.6 6.20 semver | Not specified |
| CNA | Linux | Linux | affected 7.0 | Not specified |
| CNA | Linux | Linux | unaffected 7.0 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.178 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.145 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.97 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.40 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.5 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/f79519f636059b007d6abc91652f36dea4f54a20 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/3691a82be2095abaf3326a1cbf7b25858a1d959c | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/f64e03da0d83cb173743888bff4a7e61476a8fc2 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/82e120a7dd566c476ba923d30e3fb78e8118a1dd | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/6848ca381edff84f87dd1b6973848c271541e813 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.