CVE-2026-23361

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry

Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X

interrupt to the host using a writel(), which generates a PCI posted write

transaction. There's no completion for posted writes, so the writel() may

return before the PCI write completes. dw_pcie_ep_raise_msix_irq() also

unmaps the outbound ATU entry used for the PCI write, so the write races

with the unmap.

If the PCI write loses the race with the ATU unmap, the write may corrupt

host memory or cause IOMMU errors, e.g., these when running fio with a

larger queue depth against nvmet-pci-epf:

arm-smmu-v3 fc900000.iommu: 0x0000010000000010

arm-smmu-v3 fc900000.iommu: 0x0000020000000000

arm-smmu-v3 fc900000.iommu: 0x000000090000f040

arm-smmu-v3 fc900000.iommu: 0x0000000000000000

arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION client: 0000:01:00.0 sid: 0x100

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References