CVE-2026-64430: Linux Kernel Race Condition Vulnerability

CVE-2026-64430 Overview

CVE-2026-64430 is a Linux kernel vulnerability in the Non-Transparent Bridge (NTB) Endpoint Function (EPF) driver. The flaw exists in ntb_epf_vec_isr(), which calls pci_irq_vector() from hardirq context to derive the vector number. The pci_irq_vector() function invokes msi_get_virq(), which acquires a mutex. Taking a mutex in atomic context triggers "scheduling while atomic" kernel splats and can destabilize the system, resulting in denial of service on affected kernels running the ntb_hw_epf driver.

Critical Impact
A network-reachable trigger of the NTB EPF interrupt service routine can cause kernel instability and denial of service through improper mutex acquisition in hardirq context.

Affected Products

Linux kernel versions containing the ntb_hw_epf driver prior to the referenced stable patches
Systems using the NTB Endpoint Function (EPF) driver with MSI/MSI-X interrupts
PCIe endpoint deployments relying on ntb_epf_vec_isr() for interrupt handling

Discovery Timeline

2026-07-25 - CVE-2026-64430 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64430

Vulnerability Analysis

The vulnerability resides in the Linux kernel's NTB EPF driver interrupt service routine. When an MSI/MSI-X interrupt fires, ntb_epf_vec_isr() executes in hardirq context, which forbids sleeping operations. The ISR calls pci_irq_vector() to translate a hardware vector index into a Linux IRQ number. Internally, pci_irq_vector() invokes msi_get_virq(), which acquires the MSI descriptor mutex via __mutex_lock_slowpath().

Acquiring a mutex from hardirq context violates kernel locking rules and triggers "scheduling while atomic" bug reports. Under contention, the kernel may attempt to schedule from an atomic section, producing warnings and potentially corrupting scheduler state. Repeated triggering can render the system unresponsive.

Root Cause

The root cause is an [improper locking discipline] between the interrupt handler and the MSI infrastructure. The ntb_epf_vec_isr() function assumed pci_irq_vector() was safe to call from any context, but subsequent kernel changes introduced mutex-based synchronization inside the MSI vector lookup path. The fix caches the Linux IRQ number for vector 0 at allocation time and uses it as a base offset in the ISR, eliminating the need to call pci_irq_vector() from atomic context.

Attack Vector

Exploitation requires the ability to generate interrupts on a system exposing the NTB EPF interface. In endpoint-to-host PCIe deployments, a peer that can drive doorbell or message-signaled interrupts can trigger the vulnerable ISR path repeatedly. Each invocation risks triggering the atomic-context mutex acquisition, producing kernel warnings and progressive scheduler degradation that culminates in denial of service.

No synthetic exploit code is published for this issue. Refer to the upstream kernel commits for the corrective patch details: Kernel Commit 174a97f and Kernel Commit f71e8d98.

Detection Methods for CVE-2026-64430

Indicators of Compromise

Kernel log entries containing BUG: scheduling while atomic referencing kworker or interrupt handler contexts
Call trace entries showing pci_irq_vector, msi_domain_get_virq, and ntb_epf_vec_isr in the stack
Unexplained kernel warnings originating from the ntb_hw_epf module during interrupt processing

Detection Strategies

Monitor dmesg and /var/log/kern.log for scheduling-while-atomic bug reports linked to the NTB EPF driver
Correlate kernel warnings with periods of PCIe interrupt activity on endpoints running ntb_hw_epf
Track kernel version and module inventory to identify hosts running unpatched ntb_hw_epf builds

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on scheduling while atomic patterns
Establish baselines for interrupt rates on NTB endpoints and flag sustained anomalies
Track lsmod output for ntb_hw_epf presence across the fleet and prioritize patch validation on those hosts

How to Mitigate CVE-2026-64430

Immediate Actions Required

Identify all Linux systems loading the ntb_hw_epf kernel module and inventory their kernel versions
Apply the upstream stable kernel updates that include the referenced fix commits
Where patching is not immediately feasible, unload the ntb_hw_epf module on hosts that do not require NTB EPF functionality

Patch Information

The upstream fix caches the Linux IRQ number for vector 0 during vector allocation, allowing the ISR to compute per-vector IRQ numbers without calling pci_irq_vector() from atomic context. Backports are available across multiple stable branches. Reference commits include 174a97f, 1dba844, 33bba331, 4dcddc1c, 6350df50, aff271b, and f71e8d98.

Workarounds

Blacklist the ntb_hw_epf module on systems that do not require NTB endpoint functionality
Restrict physical and logical access to PCIe endpoints capable of generating interrupts to the affected driver
Schedule kernel updates on affected hosts during the next maintenance window and validate via reboot

bash

# Blacklist the vulnerable module until patching is complete
echo "blacklist ntb_hw_epf" | sudo tee /etc/modprobe.d/blacklist-ntb-epf.conf
sudo rmmod ntb_hw_epf 2>/dev/null || true
sudo update-initramfs -u