Junglewise Threat Intelligence

CVE-2026-43448: Linux kernel race condition in nvme_poll_irqdisable

CVE-2026-43448 · Severity: medium · CVSS 4.7 · Published 2026-05-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A race condition vulnerability was identified in the Linux kernel's NVMe-over-PCI driver. This component is responsible for managing high-speed storage devices (SSDs) connected via PCI Express. An exploit could cause a system crash or instability (kernel warning/panic) during specific hardware reset or timeout events, potentially leading to a denial of service for the affected system.

Technical details

A race condition exists in nvme_poll_irqdisable() within the nvme-pci driver. The vulnerability occurs because the code calls pci_irq_vector() twice—once for disable_irq() and once for enable_irq(). If a concurrent nvme_reset_work() task disables the PCI device (setting msix_enabled to 0) between these two calls, the first call may return an MSI-X IRQ while the second returns an INTx IRQ. This results in an 'unbalanced enable' warning or kernel panic because the system attempts to enable an IRQ that was never disabled. The fix involves caching the IRQ number in a local variable to ensure both operations target the same identifier. Patches are available in various stable kernel branches.

Affected products

  • Linux Linux kernel 5.7 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3

Timeline

  • 2026-03-07: disclosed: Vulnerability reported by Sungwoo Kim
  • 2026-03-25: patched: Fix committed to stable kernel trees
  • 2026-05-08: advisory: CVE-2026-43448 published

References

Related threats