CVE-2026-80620: Revert "PCI/MSI: Unmap MSI-X region on error"
In the Linux kernel, the following vulnerability has been resolved:
Revert "PCI/MSI: Unmap MSI-X region on error"
This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202.
Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msixbase) on the error path of msixcapabilityinit() to release the MSI-X region when msixsetupinterrupts() fails.
When msixsetupinterrupts() fails, the call chain is:
msixsetupinterrupts() -> msixsetupinterrupts() struct pcidev dev free(freemsiirqs) = dev; ... return ret; // free cleanup fires on error
The free(freemsiirqs) cleanup calls pcifreemsiirqs(), which already handles the unmap:
void pcifreemsiirqs(struct pcidev dev) { pcimsiteardownmsiirqs(dev); if (dev->msixbase) { iounmap(dev->msixbase); // already unmapped here dev->msixbase = NULL; // and set to NULL } }
So dev->msixbase is unmapped and set to NULL before msixsetupinterrupts() returns to msixcapabilityinit(). The "goto outunmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer.
This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/testkexecjump.sh:
WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msixcapabilityinit+0x317/0x3f0 pcienablemsixrange+0x21d/0x2c0 pciallocirqvectorsaffinity+0xa9/0x130 nvmesetupioqueues+0x2a8/0x420 [nvme] nvmeresetwork+0x151/0x340 [nvme] ...
RDI=0 confirms iounmap() is called with NULL.
Restore the original "goto outdisable" and leave the unmap to the existing free(freemsiirqs) cleanup.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can this issue occur?
It occurs when MSI-X interrupt setup fails in msix_setup_interrupts(). The error cleanup already unmaps the MSI-X region and clears dev->msix_base, after which the reverted error path attempts a second iounmap() on the now-NULL pointer.
Which systems are realistically exposed?
Systems using the Linux kernel code containing commit 1a8d4c6ecb4c are exposed when a PCI device reaches the MSI-X setup failure path. The issue was reproduced on an Intel Emerald Rapids system, but the provided information does not limit it to that platform.
How can I determine whether my kernel includes the vulnerable behavior?
Check whether the kernel source or applied stable patches include commit 1a8d4c6ecb4c, "PCI/MSI: Unmap MSI-X region on error." The resolved change reverts that commit; the supplied stable references identify fixes.