CVE-2026-80620

CVE CVE-2026-80620EUVD EUVD-2026-67496Published 2026-08-28T06:48:40.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails. When msix_setup_interrupts() fails, the call chain is: msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap: void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } } So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer. This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh: WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ... RDI=0 confirms iounmap() is called with NULL. Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 <f64e03da0d83cb173743888bff4a7e61476a8fc2; patch: 6.12.97; 5f007c6acaa7d9a543b492c1e48c48a0ea1d7147 <6848ca381edff84f87dd1b6973848c271541e813; 6.6.128 <6.6.145; 7.0; 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 <3691a82be2095abaf3326a1cbf7b25858a1d959c; patch: 0; patch: 6.18.40; 6.12.75 <6.12.97; aee8db5f048616990dbdefcc25689ade0a2620ec <f79519f636059b007d6abc91652f36dea4f54a20; patch: 6.6.145; 6.18.16 <6.18.40; 19bf27b450fcd5309bacd614b12bd7de1ac6535b; 6.1.165 <6.1.178; 4a7589b615a3db6792d36b874add86cd22188c95 <82e120a7dd566c476ba923d30e3fb78e8118a1dd; patch: 7.1.5; patch: 6.1.178; 76f7abd4ee0188f06465bdd3c053fdc5e8595152 <0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f; 6.19.6 <6.20; patch: 7.2

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.