CVE-2026-43448 Overview
CVE-2026-43448 is a race condition vulnerability in the Linux kernel's NVMe-PCI driver, specifically in the nvme_poll_irqdisable() function in drivers/nvme/host/pci.c. The flaw occurs when a PCI device is disabled concurrently between an interrupt disable and re-enable sequence, causing pci_irq_vector() to return different IRQ numbers across calls. This mismatch leads to an unbalanced IRQ enable warning and disrupts interrupt state tracking on NVMe devices. The vulnerability surfaces when nvme_reset_work() clears pdev->msix_enabled while a timeout handler is mid-execution.
Critical Impact
A race between NVMe timeout handling and device reset can produce kernel warnings, corrupt IRQ depth accounting, and destabilize NVMe I/O on affected Linux systems.
Affected Products
- Linux kernel (NVMe-PCI driver, drivers/nvme/host/pci.c)
- Kernel builds prior to the commits listed in the kernel.org stable references
- Systems using NVMe storage over PCI/MSI-X with affected kernel versions
Discovery Timeline
- 2026-05-08 - CVE-2026-43448 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43448
Vulnerability Analysis
The vulnerability is a race condition between two concurrent kernel tasks operating on the same NVMe PCI device. Task one executes nvme_poll_irqdisable(), which calls disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)) and later enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)). Between these two calls, task two runs nvme_reset_work() which invokes nvme_dev_disable(), setting pdev->msix_enabled = 0.
Because pci_irq_vector() consults msix_enabled to decide whether to return an MSI-X vector or the legacy INTx vector, the two calls in task one can return different IRQ numbers. The first call returns an MSI-X IRQ greater than 15, while the second returns an INTx IRQ less than or equal to 15. The kernel then attempts to enable an IRQ that was never disabled, triggering the Unbalanced enable for IRQ warning in __enable_irq+0x102/0x190.
Root Cause
The defect lies in re-evaluating pci_irq_vector(pdev, nvmeq->cq_vector) twice without holding any synchronization against device disable. The function is not idempotent across an msix_enabled transition. The fix caches the IRQ number into a local variable so that disable_irq() and enable_irq() operate on the same value, keeping IRQ depth accounting balanced even if pci_free_irq_vectors() runs concurrently [CWE-362].
Attack Vector
Triggering the race requires conditions that exercise NVMe timeout handling concurrently with controller reset. The condition is reachable through workloads that stress NVMe command timeouts on PCI-attached controllers. The observable result is a kernel warning and disturbed interrupt state, with potential downstream impact on NVMe queue handling and I/O reliability. No remote network attack vector is documented for this kernel race.
See the upstream fix commits for full technical context, including kernel commit 265dbc9 and kernel commit fc71f40.
Detection Methods for CVE-2026-43448
Indicators of Compromise
- Kernel log entries containing Unbalanced enable for IRQ originating from __enable_irq+0x102/0x190 in kernel/irq/manage.c:753.
- Stack traces showing nvme_poll_irqdisable+0x162/0x1c0 invoked from nvme_timeout and blk_mq_timeout_work.
- Concurrent appearances of nvme_reset_work and nvme_dev_disable near NVMe timeout warnings.
Detection Strategies
- Monitor dmesg and /var/log/kern.log for the specific WARNING: kernel/irq/manage.c:753 signature on NVMe-equipped hosts.
- Correlate NVMe controller reset events with block layer timeout warnings to identify race exposure.
- Track kernel version inventory against the fixed commits to identify unpatched hosts.
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized logging system and alert on nvme_poll_irqdisable and Unbalanced enable for IRQ substrings.
- Track NVMe error counters and reset counts via nvme-cli and smartctl to surface controllers that repeatedly trigger timeout paths.
- Audit kernel package versions across the Linux fleet against the stable trees referenced in the advisory.
How to Mitigate CVE-2026-43448
Immediate Actions Required
- Apply the upstream NVMe-PCI fix that caches the IRQ number locally in nvme_poll_irqdisable() to ensure disable_irq() and enable_irq() operate on the same IRQ.
- Update affected systems to a kernel release that includes the referenced stable commits.
- Reboot updated hosts to load the patched kernel and validate NVMe stability under load.
Patch Information
The fix has been merged into the upstream Linux kernel and backported to stable trees. Review the following references for the exact code change: kernel commit 628773e, kernel commit 843e913, kernel commit b56c498, and kernel commit e311d84. Distribution-provided kernels should be updated through standard package channels once vendors publish fixed builds.
Workarounds
- No formal workaround exists. Reducing NVMe controller reset frequency by addressing underlying I/O timeouts may lower exposure to the race window.
- Prefer kernels with the upstream fix rather than relying on operational mitigations.
- Where feasible, schedule controller firmware updates and host kernel updates together to minimize reset events.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
