Answer in brief
CVE-2026-80620 records a Unknown severity vulnerability in Revert "PCI/MSI: Unmap MSI-X region on error". The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=4a7589b615a3db6792d36b874add86cd22188c95 <82e120a7dd566c476ba923d30e3fb78e8118a1dd || >=5f007c6acaa7d9a543b492c1e48c48a0ea1d7147 <6848ca381edff84f87dd1b6973848c271541e813 || >=76f7abd4ee0188f06465bdd3c053fdc5e8595152 <0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f || >=aee8db5f048616990dbdefcc25689ade0a2620ec <f79519f636059b007d6abc91652f36dea4f54a20 || >=1a8d4c6ecb4c81261bcdf13556abd4a958eca202 <3691a82be2095abaf3326a1cbf7b25858a1d959c || >=1a8d4c6ecb4c81261bcdf13556abd4a958eca202 <f64e03da0d83cb173743888bff4a7e61476a8fc2 || 19bf27b450fcd5309bacd614b12bd7de1ac6535b || >=6.1.165 <6.1.178 || >=6.6.128 <6.6.145 || >=6.12.75 <6.12.97 || >=6.18.16 <6.18.40 || >=6.19.6 <6.20 | 82e120a7dd566c476ba923d30e3fb78e8118a1dd, 6848ca381edff84f87dd1b6973848c271541e813, 0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f, f79519f636059b007d6abc91652f36dea4f54a20, 3691a82be2095abaf3326a1cbf7b25858a1d959c, f64e03da0d83cb173743888bff4a7e61476a8fc2, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 6.20 |
| Linux/Linuxgeneric | 7.0 | Not reported |
Published upstream
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 28, 2026
In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails. When msix_setup_interrupts() fails, the call chain is: msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap: void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } } So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer. This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh: WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ... RDI=0 confirms iounmap() is called with NULL. Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup.
Quoted source text, attributed separately from HOL analysis.