Executive brief
The Linux kernel's PCI Designware endpoint driver has a race condition in how it handles Message Signaled Interrupts (MSI) when reconfiguring PCI address mappings. A posted MSI write can be lost or misrouted if the address mapping is unmapped before the write completes, potentially causing device interrupts to fail to reach their destination or be delivered incorrectly.
Technical details
This vulnerability is a race condition in the dw_pcie_ep_raise_msi_irq() function in the PCI Designware endpoint controller driver. When an endpoint device caches an MSI target address and later observes that the Root Complex has changed it, the driver unmaps the old iATU (inbound Address Translation Unit) entry and reprograms it with the new address. However, between the MSI writel() call and the iATU unmap, posted writes in the PCIe fabric may still be in flight. Unmapping the iATU entry can drop or misroute these in-flight writes. The fix adds a readl() (memory read) operation to drain any posted MSI writes through the same iATU entry before unmapping it, which synchronizes the write completion. This is the same mechanism already used in the MSI-X path. The vulnerability requires PCI endpoint mode and MSI reconfiguration to be triggered.
Affected products
- Linux Linux kernel affected versions including PCI DWC endpoint support
Timeline
- 2026-09-17: disclosed
- 2026-07-30: patched: Patch commit 1b01d725d8b42450b86a857bab3c46856c740166 by Niklas Cassel