HIGH
pci dwc MSI-X Race
CVE-2026-23361
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X interrupt to the host using a writel(), which generates a PCI posted write transaction. There's no completion for posted writes, so the writel() may return before the PCI write completes. dw_pcie_ep_raise_msix_irq() also unmaps the outbound ATU entry used for the PCI write, so the write races with the unmap. If the PCI write loses the race with the ATU unmap, the write may corrupt host memory or cause IOMMU errors, e.g., these when running fio with a larger queue depth against nvmet-pci-epf: arm-smmu-v3 fc900000.iommu: 0x0000010000000010 arm-smmu-v3 fc900000.iommu: 0x0000020000000000 arm-smmu-v3 fc900000.iommu: 0x000000090000f040 arm-smmu-v3 fc900000.iommu: 0x0000000000000000 arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION client: 0000:01:00.0 sid: 0x100 ssid: 0x0 iova: 0x90000f040 ipa: 0x0 arm-smmu-v3 fc900000.iommu: unpriv data write s1 "Input address caused fault" stag: 0x0 Flush the write by performing a readl() of the same address to ensure that the write has reached the destination before the ATU entry is unmapped. The same problem was solved for dw_pcie_ep_raise_msi_irq() in commit 8719c64e76bf ("PCI: dwc: ep: Cache MSI outbound iATU mapping"), but there it was solved by dedicating an outbound iATU only for MSI. We can't do the same for MSI-X because each vector can have a different msg_addr and the msg_addr may be changed while the vector is masked. [bhelgaas: commit log]
02KernelScan AI Analysis
Risk summary
A race condition in PCI MSI-X interrupt handling can cause memory corruption or system errors when the interrupt write operation races with address translation cleanup. This primarily affects embedded systems and servers with DesignWare PCIe endpoint controllers during high-throughput operations.
Vulnerability analysis
Root Cause: The dw_pcie_ep_raise_msix_irq() function performs a writel() to generate a PCI posted write transaction for MSI-X interrupt delivery, then immediately unmaps the outbound ATU entry used for the write. Since posted writes have no completion guarantee, the writel() can return before the PCI write actually completes, creating a race condition where the ATU entry gets unmapped while the write is still in flight.
Attack Surface: This affects PCI endpoint devices using the DesignWare PCIe controller with MSI-X interrupt capability. The vulnerability is triggered during normal MSI-X interrupt operations and requires physical access to a system with affected PCI endpoint hardware. The race condition can lead to memory corruption or IOMMU translation faults.
Fix Mechanism: The patch adds a readl() operation on the same address immediately after the writel() and before unmapping the ATU entry. This read operation flushes the posted write by forcing it to complete before the read can return, ensuring the MSI-X write reaches its destination before the ATU mapping is removed.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.12 | 6.12.77 | a7afb8f810c0 |
| 6.18 | 6.18.17 | 6f60a783860c |
| 6.19 | 6.19.7 | eaa6a56801dd |
| mainline | 7.0 | c22533c66cca |