---
id: CVE-2026-80620
title: 'Revert "PCI/MSI: Unmap MSI-X region on error"'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Revert "PCI/MSI: Unmap MSI-X region on error"

  This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202.

  Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4a7589b615a3db6792d36b874add86cd22188c95 <
    82e120a7dd566c476ba923d30e3fb78e8118a1dd
  - >-
    Linux >= 5f007c6acaa7d9a543b492c1e48c48a0ea1d7147 <
    6848ca381edff84f87dd1b6973848c271541e813
  - >-
    Linux >= 76f7abd4ee0188f06465bdd3c053fdc5e8595152 <
    0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f
  - >-
    Linux >= aee8db5f048616990dbdefcc25689ade0a2620ec <
    f79519f636059b007d6abc91652f36dea4f54a20
  - >-
    Linux >= 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 <
    3691a82be2095abaf3326a1cbf7b25858a1d959c
  - >-
    Linux >= 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 <
    f64e03da0d83cb173743888bff4a7e61476a8fc2
  - Linux 19bf27b450fcd5309bacd614b12bd7de1ac6535b
  - Linux >= 6.1.165 < 6.1.178
  - Linux >= 6.6.128 < 6.6.145
  - Linux >= 6.12.75 < 6.12.97
  - Linux >= 6.18.16 < 6.18.40
  - Linux >= 6.19.6 < 6.20
  - Linux 7.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:02:14.673499Z'
published: '2026-08-28'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:52.238Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80620'
references:
  - url: 'https://git.kernel.org/stable/c/82e120a7dd566c476ba923d30e3fb78e8118a1dd'
  - url: 'https://git.kernel.org/stable/c/6848ca381edff84f87dd1b6973848c271541e813'
  - url: 'https://git.kernel.org/stable/c/0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f'
  - url: 'https://git.kernel.org/stable/c/f79519f636059b007d6abc91652f36dea4f54a20'
  - url: 'https://git.kernel.org/stable/c/3691a82be2095abaf3326a1cbf7b25858a1d959c'
  - url: 'https://git.kernel.org/stable/c/f64e03da0d83cb173743888bff4a7e61476a8fc2'
tags:
  - cve.org
epss: 0.00215
epssPercentile: 0.11892
ingestedAt: '2026-11-06T18:00:12.539Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Revert "PCI/MSI: Unmap MSI-X region on error"

This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202.

Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an
iounmap(dev->msix_base) on the error path of msix_capability_init() to
release the MSI-X region when msix_setup_interrupts() fails.

When msix_setup_interrupts() fails, the call chain is:

  msix_setup_interrupts()
    -> __msix_setup_interrupts()
         struct pci_dev *dev __free(free_msi_irqs) = __dev;
         ...
         return ret;  // __free cleanup fires on error

The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which
already handles the unmap:

  void pci_free_msi_irqs(struct pci_dev *dev)
  {
      pci_msi_teardown_msi_irqs(dev);
      if (dev->msix_base) {
          iounmap(dev->msix_base);   // already unmapped here
          dev->msix_base = NULL;     // and set to NULL
      }
  }

So dev->msix_base is unmapped and set to NULL before
msix_setup_interrupts() returns to msix_capability_init(). The
"goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap
MSI-X region on error") then calls iounmap() a second time on a NULL
pointer.

This was reproduced on Intel Emerald Rapids (192 CPUs) while
running tools/testing/selftests/kexec/test_kexec_jump.sh:

  WARNING: CPU#44 at iounmap+0x2a/0xe0
  RIP: 0010:iounmap+0x2a/0xe0
  RDI: 0000000000000000
  Call Trace:
   msix_capability_init+0x317/0x3f0
   __pci_enable_msix_range+0x21d/0x2c0
   pci_alloc_irq_vectors_affinity+0xa9/0x130
   nvme_setup_io_queues+0x2a8/0x420 [nvme]
   nvme_reset_work+0x151/0x340 [nvme]
   ...

RDI=0 confirms iounmap() is called with NULL.

Restore the original "goto out_disable" and leave the unmap to the
existing __free(free_msi_irqs) cleanup.

## Affected

- `Linux >= 4a7589b615a3db6792d36b874add86cd22188c95 < 82e120a7dd566c476ba923d30e3fb78e8118a1dd`
- `Linux >= 5f007c6acaa7d9a543b492c1e48c48a0ea1d7147 < 6848ca381edff84f87dd1b6973848c271541e813`
- `Linux >= 76f7abd4ee0188f06465bdd3c053fdc5e8595152 < 0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f`
- `Linux >= aee8db5f048616990dbdefcc25689ade0a2620ec < f79519f636059b007d6abc91652f36dea4f54a20`
- `Linux >= 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 < 3691a82be2095abaf3326a1cbf7b25858a1d959c`
- `Linux >= 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 < f64e03da0d83cb173743888bff4a7e61476a8fc2`
- `Linux 19bf27b450fcd5309bacd614b12bd7de1ac6535b`
- `Linux >= 6.1.165 < 6.1.178`
- `Linux >= 6.6.128 < 6.6.145`
- `Linux >= 6.12.75 < 6.12.97`
- `Linux >= 6.18.16 < 6.18.40`
- `Linux >= 6.19.6 < 6.20`
- `Linux 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.