Skip to main content
VulnerabilityPublished Updated

CVE-2026-80620: Linux kernel · Revert "PCI/MSI: Unmap MSI-X region on error

Affects Linux kernelSource GCVE Database

0

Not known to be exploited · fixed in 6.8.0-147.147 : update Linux kernel when convenient.

Data as of 28 Oct 2026, 01:00 UTC

Severity
Medium

Rated by Threat Radar · CVSS not yet scored by NVD

Patch
Available – fixed in 6.8.0-147.147, 6.8.0-1067.70, 7.0.0-1014.14~24.04.1 +25

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 28 Aug 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
Ubuntu 26.04 LTSlinuxpkg:deb/ubuntu/linux?arch=source&distro=resoluteOther threatsAffected
  • <7.0.0-38.38
Fixed in
  • 7.0.0-38.38
Ubuntu 26.04 LTSlinux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=resoluteOther threatsAffected
  • <7.0.0-1014.14
Fixed in
  • 7.0.0-1014.14
Ubuntu 26.04 LTSlinux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=resoluteOther threatsAffected
  • <7.0.0-1017.17
Fixed in
  • 7.0.0-1017.17
Ubuntu 26.04 LTSlinux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resoluteOther threatsAffected
  • <7.0.0-1016.16
Fixed in
  • 7.0.0-1016.16
Ubuntu 26.04 LTSlinux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=resoluteOther threatsAffected
  • <7.0.0-1014.14
Fixed in
  • 7.0.0-1014.14
Ubuntu 26.04 LTSlinux-gkepkg:deb/ubuntu/linux-gke?arch=source&distro=resoluteOther threatsAffected
  • <7.0.0-1008.9
Fixed in
  • 7.0.0-1008.9

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails. When msix_setup_interrupts() fails, the call chain is: msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap: void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } } So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer. This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh: WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ... RDI=0 confirms iounmap() is called with NULL. Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup.

References

Community reviews

Loading reviews…