CVE-2026-23361

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23361", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.001Z", "datePublished": "2026-03-25T10:27:44.750Z", "dateUpdated": "2026-10-30T12:23:59.146Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:23:59.146Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry\n\nEndpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X\ninterrupt to the host using a writel(), which generates a PCI posted write\ntransaction. There's no completion for posted writes, so the writel() may\nreturn before the PCI write completes. dw_pcie_ep_raise_msix_irq() also\nunmaps the outbound ATU entry used for the PCI write, so the write races\nwith the unmap.\n\nIf the PCI write loses the race with the ATU unmap, the write may corrupt\nhost memory or cause IOMMU errors, e.g., these when running fio with a\nlarger queue depth against nvmet-pci-epf:\n\n arm-smmu-v3 fc900000.iommu: 0x0000010000000010\n arm-smmu-v3 fc900000.iommu: 0x0000020000000000\n arm-smmu-v3 fc900000.iommu: 0x000000090000f040\n arm-smmu-v3 fc900000.iommu: 0x0000000000000000\n arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION client: 0000:01:00.0 sid: 0x100 ssid: 0x0 iova: 0x90000f040 ipa: 0x0\n arm-smmu-v3 fc900000.iommu: unpriv data write s1 \"Input address caused fault\" stag: 0x0\n\nFlush the write by performing a readl() of the same address to ensure that\nthe write has reached the destination before the ATU entry is unmapped.\n\nThe same problem was solved for dw_pcie_ep_raise_msi_irq() in commit\n8719c64e76bf (\"PCI: dwc: ep: Cache MSI outbound iATU mapping\"), but there\nit was solved by dedicating an outbound iATU only for MSI. We can't do the\nsame for MSI-X because each vector can have a different msg_addr and the\nmsg_addr may be changed while the vector is masked.\n\n[bhelgaas: commit log]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/pci/controller/dwc/pcie-designware-ep.c"], "versions": [{"version": "beb4641a787df79a1423a8789d185b6b78fcbfea", "lessThan": "1d35fc94cd723ae27371a31f404685a24b097d71", "status": "affected", "versionType": "git"}, {"version": "beb4641a787df79a1423a8789d185b6b78fcbfea", "lessThan": "5e2fc90018635fc982d39f8c11cd3b368fdaf3b7", "status": "affected", "versionType": "git"}, {"version": "beb4641a787df79a1423a8789d185b6b78fcbfea", "lessThan": "a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0", "status": "affected", "versionType": "git"}, {"version": "beb4641a787df79a1423a8789d185b6b78fcbfea", "lessThan": "6f60a783860c77b309f7d81003b6a0c73feca49e", "status": "affected", "versionType": "git"}, {"version": "beb4641a787df79a1423a8789d185b6b78fcbfea", "lessThan": "eaa6a56801ddd2d9b4980f19e7fe002b00994804", "status": "affected", "versionType": "git"}, {"version": "beb4641a787df79a1423a8789d185b6b78fcbfea", "lessThan": "c22533c66ccae10511ad6a7afc34bb26c47577e3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/pci/controller/dwc/pcie-designware-ep.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.77", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.77"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1d35fc94cd723ae27371a31f404685a24b097d71"}, {"url": "https://git.kernel.org/stable/c/5e2fc90018635fc982d39f8c11cd3b368fdaf3b7"}, {"url": "https://git.kernel.org/stable/c/a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0"}, {"url": "https://git.kernel.org/stable/c/6f60a783860c77b309f7d81003b6a0c73feca49e"}, {"url": "https://git.kernel.org/stable/c/eaa6a56801ddd2d9b4980f19e7fe002b00994804"}, {"url": "https://git.kernel.org/stable/c/c22533c66ccae10511ad6a7afc34bb26c47577e3"}], "title": "PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/pci/controller/dwc/pcie-designware-ep.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1d35fc94cd723ae27371a31f404685a24b097d71", "status": "affected", "version": "beb4641a787df79a1423a8789d185b6b78fcbfea", "versionType": "git"}, {"lessThan": "5e2fc90018635fc982d39f8c11cd3b368fdaf3b7", "status": "affected", "version": "beb4641a787df79a1423a8789d185b6b78fcbfea", "versionType": "git"}, {"lessThan": "a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0", "status": "affected", "version": "beb4641a787df79a1423a8789d185b6b78fcbfea", "versionType": "git"}, {"lessThan": "6f60a783860c77b309f7d81003b6a0c73feca49e", "status": "affected", "version": "beb4641a787df79a1423a8789d185b6b78fcbfea", "versionType": "git"}, {"lessThan": "eaa6a56801ddd2d9b4980f19e7fe002b00994804", "status": "affected", "version": "beb4641a787df79a1423a8789d185b6b78fcbfea", "versionType": "git"}, {"lessThan": "c22533c66ccae10511ad6a7afc34bb26c47577e3", "status": "affected", "version": "beb4641a787df79a1423a8789d185b6b78fcbfea", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/pci/controller/dwc/pcie-designware-ep.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.77", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.17", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9CC70BD7-E7C9-4802-B345-09DF8AE28044", "versionEndExcluding": "6.12.77", "versionStartIncluding": "4.19.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5E006E4-59C7-43C1-9231-62A72219F2BA", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.19:-:*:*:*:*:*:*", "matchCriteriaId": "CFDAD450-8799-4C2D-80CE-2AA45DEC35CE", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry\n\nEndpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X\ninterrupt to the host using a writel(), which generates a PCI posted write\ntransaction. There's no completion for posted writes, so the writel() may\nreturn before the PCI write completes. dw_pcie_ep_raise_msix_irq() also\nunmaps the outbound ATU entry used for the PCI write, so the write races\nwith the unmap.\n\nIf the PCI write loses the race with the ATU unmap, the write may corrupt\nhost memory or cause IOMMU errors, e.g., these when running fio with a\nlarger queue depth against nvmet-pci-epf:\n\n arm-smmu-v3 fc900000.iommu: 0x0000010000000010\n arm-smmu-v3 fc900000.iommu: 0x0000020000000000\n arm-smmu-v3 fc900000.iommu: 0x000000090000f040\n arm-smmu-v3 fc900000.iommu: 0x0000000000000000\n arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION client: 0000:01:00.0 sid: 0x100 ssid: 0x0 iova: 0x90000f040 ipa: 0x0\n arm-smmu-v3 fc900000.iommu: unpriv data write s1 \"Input address caused fault\" stag: 0x0\n\nFlush the write by performing a readl() of the same address to ensure that\nthe write has reached the destination before the ATU entry is unmapped.\n\nThe same problem was solved for dw_pcie_ep_raise_msi_irq() in commit\n8719c64e76bf (\"PCI: dwc: ep: Cache MSI outbound iATU mapping\"), but there\nit was solved by dedicating an outbound iATU only for MSI. We can't do the\nsame for MSI-X because each vector can have a different msg_addr and the\nmsg_addr may be changed while the vector is masked.\n\n[bhelgaas: commit log]"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nPCI: dwc: ep: Vaciar escritura MSI-X antes de desmapear su entrada ATU\n\nLos controladores de punto final usan dw_pcie_ep_raise_msix_irq() para generar una interrupci\u00f3n MSI-X al host usando un writel(), lo que genera una transacci\u00f3n de escritura publicada PCI. No hay finalizaci\u00f3n para las escrituras publicadas, por lo que el writel() puede regresar antes de que la escritura PCI se complete. dw_pcie_ep_raise_msix_irq() tambi\u00e9n desmapea la entrada ATU de salida usada para la escritura PCI, por lo que la escritura compite con el desmapeo.\n\nSi la escritura PCI pierde la carrera con el desmapeo ATU, la escritura puede corromper la memoria del host o causar errores de IOMMU, por ejemplo, estos al ejecutar fio con una profundidad de cola mayor contra nvmet-pci-epf:\n\n arm-smmu-v3 fc900000.iommu: 0x0000010000000010\n arm-smmu-v3 fc900000.iommu: 0x0000020000000000\n arm-smmu-v3 fc900000.iommu: 0x000000090000f040\n arm-smmu-v3 fc900000.iommu: 0x0000000000000000\n arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION cliente: 0000:01:00.0 sid: 0x100 ssid: 0x0 iova: 0x90000f040 ipa: 0x0\n arm-smmu-v3 fc900000.iommu: unpriv data write s1 'Input address caused fault' stag: 0x0\n\nVaciar la escritura realizando un readl() de la misma direcci\u00f3n para asegurar que la escritura ha alcanzado el destino antes de que la entrada ATU sea desmapeada.\n\nEl mismo problema fue resuelto para dw_pcie_ep_raise_msi_irq() en el commit 8719c64e76bf ('PCI: dwc: ep: Cacheo de mapeo iATU de salida MSI'), pero all\u00ed fue resuelto dedicando un iATU de salida solo para MSI. No podemos hacer lo mismo para MSI-X porque cada vector puede tener una msg_addr diferente y la msg_addr puede ser cambiada mientras el vector est\u00e1 enmascarado.\n\n[bhelgaas: registro de commit]"}], "id": "CVE-2026-23361", "lastModified": "2026-10-30T13:18:37.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-25T11:16:35.060", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1d35fc94cd723ae27371a31f404685a24b097d71"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5e2fc90018635fc982d39f8c11cd3b368fdaf3b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6f60a783860c77b309f7d81003b6a0c73feca49e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c22533c66ccae10511ad6a7afc34bb26c47577e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eaa6a56801ddd2d9b4980f19e7fe002b00994804"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry", "id": "2451210", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451210"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel. A race condition exists in the handling of Message Signaled Interrupts eXtended (MSI-X) within the PCI subsystem. When an MSI-X interrupt is raised, a PCI posted write transaction may not complete before its associated Address Translation Unit (ATU) entry is unmapped. This timing issue can lead to memory corruption or Input/Output Memory Management Unit (IOMMU) errors on the host system."], "name": "CVE-2026-23361", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23361\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23361\nhttps://lore.kernel.org/linux-cve-announce/2026032539-CVE-2026-23361-bd5c@gregkh/T"], "statement": "This flaw affects systems using DesignWare PCI endpoint controllers (dwc) with MSI-X. The race between the posted write and ATU unmap can cause the write to go to unmapped address space, corrupting host memory or triggering IOMMU faults. Primarily affects embedded systems using PCI endpoint functionality with NVMe target emulation.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[beb4641a787df79a1423a8789d185b6b78fcbfea,a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[beb4641a787df79a1423a8789d185b6b78fcbfea,6f60a783860c77b309f7d81003b6a0c73feca49e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[beb4641a787df79a1423a8789d185b6b78fcbfea,eaa6a56801ddd2d9b4980f19e7fe002b00994804)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[beb4641a787df79a1423a8789d185b6b78fcbfea,c22533c66ccae10511ad6a7afc34bb26c47577e3)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.19,4.19]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.77,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T17:04:29.117368+00:00", "value": {"mitigation_remediation": ["Update the kernel to a version that includes the upstream fix referenced in commit 6f60a783.", "If immediate upgrade is infeasible, consider disabling MSI\u2011X for the affected device or uninstalling the faulty endpoint driver to prevent the race.", "If neither patch nor disabling MSI\u2011X is possible, isolate the device by allocating a dedicated IOMMU domain to contain any potential memory corruption."], "summary": {"action": "Patch", "impact": "Memory corruption and IOMMU errors"}, "threat_synthesis": {"affected_systems": "The issue exists in the Linux kernel\u2019s dwc endpoint drivers and affects all kernel versions that include the dv_pcie_ep_raise_msix_irq routine before the patch that ensures the write completes before the ATU is unmapped. The problem exists across all Linux distributions that compile the kernel with this driver, as no vendor\u2011specific version restrictions were identified.", "description_and_impact": "The vulnerability arises from a race condition between a PCI posted write used to raise an MSI\u2011X interrupt and the subsequent unmap of the outbound address translation entry (ATU). If the write races with the unmap, host memory may be corrupted or IOMMU translations may fault, leading to data integrity breaches or kernel stability problems. With a CVSS score of 7.8, this is a high\u2011severity issue. It represents a Classic Atomicity violation (CWE\u2011367) and a Buffer Over\u2011read (CWE\u2011787) that undermine PCI transaction sequencing, potentially exposing confidential data or causing denial of service.", "risk_and_exploitability": "With a CVSS score of 7.8 and an EPSS of less than 1\u202f%, the risk of exploitation is high in severity but still low probability. The attack requires control over or interaction with a PCI\u2011E endpoint device that triggers MSI\u2011X interrupts; an attacker could cause memory corruption or trigger IOMMU faults to destabilize the host. The vulnerability is not listed in the CISA KEV catalog, and there is no public exploit known, but defenses\u2011against\u2011failure techniques recommend addressing it promptly."}}}}, "created": "2026-03-25T21:31:54.782027+00:00", "updated": "2026-04-28T17:15:21.236275+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}