CVE-2026-80620
- Source
- https://cve.org/CVERecord?id=CVE-2026-80620
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80620.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-80620
- Downstream
- Published
- 2026-08-28T06:48:40Z
- Modified
- 2026-10-08T02:52:03Z
- Summary
- Revert "PCI/MSI: Unmap MSI-X region on error"
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Revert "PCI/MSI: Unmap MSI-X region on error"
This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202.
Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails.
When msix_setup_interrupts() fails, the call chain is:
msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error
The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap:
void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } }
So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer.
This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh:
WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ...
RDI=0 confirms iounmap() is called with NULL.
Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80620.json" }- References
-
- https://git.kernel.org/stable/c/0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f
- https://git.kernel.org/stable/c/3691a82be2095abaf3326a1cbf7b25858a1d959c
- https://git.kernel.org/stable/c/6848ca381edff84f87dd1b6973848c271541e813
- https://git.kernel.org/stable/c/82e120a7dd566c476ba923d30e3fb78e8118a1dd
- https://git.kernel.org/stable/c/f64e03da0d83cb173743888bff4a7e61476a8fc2
- https://git.kernel.org/stable/c/f79519f636059b007d6abc91652f36dea4f54a20
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80620.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-80620
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4a7589b615a3db6792d36b874add86cd22188c95Fixed82e120a7dd566c476ba923d30e3fb78e8118a1dd
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5f007c6acaa7d9a543b492c1e48c48a0ea1d7147Fixed6848ca381edff84f87dd1b6973848c271541e813
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced76f7abd4ee0188f06465bdd3c053fdc5e8595152Fixed0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedaee8db5f048616990dbdefcc25689ade0a2620ecFixedf79519f636059b007d6abc91652f36dea4f54a20
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1a8d4c6ecb4c81261bcdf13556abd4a958eca202Fixed3691a82be2095abaf3326a1cbf7b25858a1d959cFixedf64e03da0d83cb173743888bff4a7e61476a8fc2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.1.165Fixed6.1.178
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.128Fixed6.6.145
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.75Fixed6.12.97
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.18.16Fixed6.18.40
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.19.6Fixed6.20
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced19bf27b450fcd5309bacd614b12bd7de1ac6535b
Affected versions
v6.*
Linux / Kernel
Package
- Name
- Kernel
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed6.1.178
- Type
- ECOSYSTEM
- Events
-
Introduced6.2.0Fixed6.6.145
- Type
- ECOSYSTEM
- Events
-
Introduced6.7.0Fixed6.12.97
- Type
- ECOSYSTEM
- Events
-
Introduced6.13.0Fixed6.18.40
- Type
- ECOSYSTEM
- Events
-
Introduced6.19.0Fixed7.1.5