Executive brief
A bug in the Linux kernel's PCI MSI-X (Message Signaled Interrupts) error handling causes a memory region to be unmapped twice during an interrupt setup failure. While the direct impact is typically a kernel warning rather than exploitable harm, such double-free conditions can lead to memory corruption, crashes, or potential security issues in certain scenarios. Systems using high-CPU Intel Emerald Rapids processors with NVMe devices are particularly affected when interrupt initialization fails.
Technical details
This is a use-after-free (or double-free) vulnerability in the msix_capability_init() error path of the Linux kernel's PCI/MSI driver. The root cause is redundant unmapping logic: commit 1a8d4c6 added an explicit iounmap(dev->msix_base) in the error path, but the cleanup is already handled by the __free(free_msi_irqs) attribute that automatically calls pci_free_msi_irqs() on function exit. When msix_setup_interrupts() fails, the __free cleanup fires first and unmaps the region, setting dev->msix_base to NULL; the subsequent goto out_unmap then calls iounmap() again on NULL. The vulnerability requires the interrupt setup path to fail during PCI device initialization (network/adjacent vector for local system processes). Patches involve reverting the problematic commit to rely solely on the __free cleanup mechanism. The issue was observed on Intel Emerald Rapids systems running kexec tests with NVMe devices.
Affected products
- Linux Linux kernel affected versions include 6.x with commit 1a8d4c6ecb4c (exact range not specified in advisory)
Timeline
- 2026-08-28: disclosed
- other: Identified as related to commit 1a8d4c6ecb4c in PCI/MSI error handling