CVE-2026-80620: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80620 Overview

CVE-2026-80620 affects the Linux kernel's PCI Message Signaled Interrupts eXtended (MSI-X) subsystem. The issue stems from a prior fix (commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error") that introduced a double iounmap() call on the error path of msix_capability_init(). When msix_setup_interrupts() fails, the existing __free(free_msi_irqs) cleanup already calls iounmap(dev->msix_base) and sets the pointer to NULL. The added goto out_unmap then invokes iounmap() a second time on the now-NULL pointer. The upstream resolution reverts the offending commit and restores the original goto out_disable label.

Critical Impact
Triggers a kernel WARNING at iounmap+0x2a/0xe0 during MSI-X setup failures, reproducible on Intel Emerald Rapids systems running NVMe reset workflows and kexec tests.

Affected Products

Linux kernel versions containing commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error")
Systems using PCI MSI-X interrupts, including NVMe storage stacks
Multi-socket x86_64 platforms such as Intel Emerald Rapids

Discovery Timeline

2026-08-28 - CVE-2026-80620 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80620

Vulnerability Analysis

The defect resides in drivers/pci/msi/msi.c, specifically the error handling path of msix_capability_init(). The prior commit 1a8d4c6ecb4c added an iounmap(dev->msix_base) inside an out_unmap label to release the MSI-X mapped region on failure. This addition did not account for the existing __free(free_msi_irqs) scope-based cleanup in __msix_setup_interrupts().

The __free cleanup invokes pci_free_msi_irqs(), which already unmaps dev->msix_base and assigns NULL before control returns to the caller. Consequently, the newly introduced goto out_unmap passes a NULL pointer into iounmap(), producing a kernel warning. Reports show the fault reproducing on a 192-CPU Intel Emerald Rapids system when the NVMe driver invoked pci_alloc_irq_vectors_affinity() during nvme_reset_work().

Root Cause

The root cause is a duplicated resource-release path. Two cleanup mechanisms—the explicit goto out_unmap and the implicit __free(free_msi_irqs) scope guard—both attempt to unmap the same MSI-X region. Since scope-based cleanup executes on function return, it runs after the explicit unmap, and the second iounmap() receives a NULL argument.

Attack Vector

This is a kernel logic defect exposed under legitimate error conditions in MSI-X initialization, not a remotely exploitable flaw. Triggering the warning requires msix_setup_interrupts() to fail during PCI device initialization, which typically occurs during device probe, reset, or kexec-driven re-initialization. The impact is a WARN_ON splat and noisy kernel logs rather than memory corruption or privilege escalation.

The reported call chain observed on affected systems traversed msix_capability_init → __pci_enable_msix_range → pci_alloc_irq_vectors_affinity → nvme_setup_io_queues → nvme_reset_work, with register RDI=0 confirming the NULL argument to iounmap().

Detection Methods for CVE-2026-80620

Indicators of Compromise

Kernel log entries containing WARNING: CPU#N at iounmap+0x2a/0xe0 with RDI: 0000000000000000.
Stack traces showing msix_capability_init+0x317/0x3f0 followed by __pci_enable_msix_range and NVMe reset frames.
Repeated warnings during kexec transitions or NVMe controller resets on MSI-X capable devices.

Detection Strategies

Parse dmesg and /var/log/kern.log for the iounmap warning signature associated with MSI-X initialization failures.
Correlate warnings with PCI device probe failures, particularly on NVMe and other high-queue-count devices.
Monitor kernel versions in fleet inventory for builds containing the vulnerable commit 1a8d4c6ecb4c prior to the revert.

Monitoring Recommendations

Enable panic_on_warn in test environments to catch regressions early during kernel qualification.
Aggregate kernel warnings from production hosts into a centralized log platform for signature-based alerting.
Track kexec and NVMe reset event frequency to identify systems most likely to surface the warning.

How to Mitigate CVE-2026-80620

Immediate Actions Required

Apply the upstream revert that removes the erroneous goto out_unmap from msix_capability_init().
Update stable kernel branches to the versions containing the referenced fix commits.
Validate that MSI-X error paths no longer emit iounmap warnings after patching.

Patch Information

The fix reverts commit 1a8d4c6ecb4c and restores the original goto out_disable, leaving MSI-X region unmapping to the existing __free(free_msi_irqs) cleanup in pci_free_msi_irqs(). Backports are available in multiple stable branches. Refer to the kernel commits: 0a2aeb0, 3691a82, 6848ca3, 82e120a, f64e03d, and f79519f.

Workarounds

No functional workaround exists at runtime; the warning is emitted from the kernel error path itself.
Reduce exposure by avoiding forced NVMe controller resets and kexec cycles on affected builds until patched.
Rebuild custom kernels from source with the revert applied when distribution updates are not yet available.