CVE-2026-43448

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: Fix race bug in nvme_poll_irqdisable()

In the following scenario, pdev can be disabled between (1) and (3) by

(2). This sets pdev->msix_enabled = 0. Then, pci_irq_vector() will

return MSI-X IRQ(>15) for (1) whereas return INTx IRQ(<=15) for (2).

This causes IRQ warning because it tries to enable INTx IRQ that has

never been disabled before.

To fix this, save IRQ number into a local variable and ensure

disable_irq() and enable_irq() operate on the same IRQ number. Even if

pci_free_irq_vectors() frees the IRQ concurrently, disable_irq() and

enable_irq() on a stale IRQ number is still valid and safe, and the

depth accounting reamins balanced.

task 1:

nvme_poll_irqdisable()

disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)) ...(1)

enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)) ...(3)

task 2:

nvme_reset_work()

nvme_dev_disable()

pdev->msix_enable = 0; ...(2)

crash log:

------------[ cut he

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References