Skip to content
Heist/ feed
Unrated

PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X interrupt to the host using a writel(), which generates a PCI posted write transaction. There's no completion for posted writes, so the writel() may return before the PCI write completes. dw_pcie_ep_raise_msix_irq() also unmaps the outbound ATU entry used for the PCI write, so the write races with the unmap. If the PCI write loses the race with the ATU unmap, the write may corrupt host memory or cause IOMMU errors, e.g., these when running fio with a larger queue depth against nvmet-pci-epf: arm-smmu-v3 fc900000.iommu: 0x0000010000000010 arm-smmu-v3 fc900000.iommu: 0x0000020000000000 arm-smmu-v3 fc900000.iommu: 0x000000090000f040 arm-smmu-v3 fc900000.iommu: 0x0000000000000000 arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION client: 0000:01:00.0 sid: 0x100 ssid: 0x0 iova: 0x90000f040 ipa: 0x0 arm-smmu-v3 fc900000.iommu: unpriv data write s1 "Input address caused fault" stag: 0x0 Flush the write by performing a readl() of the same address to ensure that the write has reached the destination before the ATU entry is unmapped. The same problem was solved for dw_pcie_ep_raise_msi_irq() in commit 8719c64e76bf ("PCI: dwc: ep: Cache MSI outbound iATU mapping"), but there it was solved by dedicating an outbound iATU only for MSI. We can't do the same for MSI-X because each vector can have a

Announced Source revision 1
Original source ↗

CVE-2026-23361

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-23361

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "beb4641a787df79a1423a8789d185b6b78fcbfea",
        "lessThan": "5e2fc90018635fc982d39f8c11cd3b368fdaf3b7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "beb4641a787df79a1423a8789d185b6b78fcbfea",
        "lessThan": "a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "beb4641a787df79a1423a8789d185b6b78fcbfea",
        "lessThan": "6f60a783860c77b309f7d81003b6a0c73feca49e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "beb4641a787df79a1423a8789d185b6b78fcbfea",
        "lessThan": "eaa6a56801ddd2d9b4980f19e7fe002b00994804",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "beb4641a787df79a1423a8789d185b6b78fcbfea",
        "lessThan": "c22533c66ccae10511ad6a7afc34bb26c47577e3",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/pci/controller/dwc/pcie-designware-ep.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.19"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.19",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.77",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.17",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19.7",
        "versionType": "semver",
        "lessThanOrEqual": "6.19.*"
      },
      {
        "status": "unaffected",
        "version": "7.0",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/pci/controller/dwc/pcie-designware-ep.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-23361

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#46119 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement