CVE-2026-80620
Received Received - Intake

PCI/MSI Double iounmap in Linux Kernel

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails. When msix_setup_interrupts() fails, the call chain is: msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap: void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } } So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer. This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh: WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ... RDI=0 confirms iounmap() is called with NULL. Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80620
EUVD
EUVD-2026-67496

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a double iounmap() call occurs on a NULL pointer in the PCI/MSI subsystem. The issue stems from a reverted commit that attempted to unmap the MSI-X region on error but ended up calling iounmap() twice. The first unmap happens in the normal cleanup path, and the second occurs due to the goto statement introduced by the reverted commit.

Detection Guidance

This vulnerability is specific to the Linux kernel's PCI/MSI subsystem and may not have direct network detection methods. Check kernel logs for NULL pointer dereference warnings in iounmap or PCI-related errors. Commands like dmesg | grep -i iounmap or journalctl -k | grep -i pci may help identify issues.

Impact Analysis

This vulnerability can cause a kernel panic or system crash when the iounmap() function is called on a NULL pointer. This typically occurs during PCI device initialization or error handling, potentially leading to system instability or denial of service.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it involves a kernel-level memory mapping issue in the Linux PCI/MSI subsystem. No data exposure or integrity issues are described that would impact regulatory compliance.

Mitigation Strategies

Apply the latest Linux kernel patches to revert the problematic commit. Monitor system logs for PCI/MSI errors. If affected, consider disabling MSI-X interrupts as a temporary workaround by adding pci=nomsi to kernel boot parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80620. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart