CVE-2026-80620

A flaw was found in the Linux kernel. During the error handling of Message Signaled Interrupts eXtended (MSI-X) region setup, the kernel attempts to unmap an already freed memory region. This double unmap operation on a null pointer can lead to a kernel warning or crash. A local attacker could potentially exploit this vulnerability to cause a system-wide Denial of Service (DoS).

A moderate-severity denial of service flaw was found in the Linux kernel PCI/MSI-X error handling. When MSI-X interrupt setup fails, the existing cleanup path (pci_free_msi_irqs via the __free(free_msi_irqs) handler) already unmaps the MSI-X region and sets dev->msix_base to NULL; the extra iounmap() introduced by upstream commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on that NULL pointer, producing a kernel warning or crash. A local attacker able to trigger a failure during MSI-X vector allocation for a PCI device (for example through a driver such as nvme) could use this flaw to cause a kernel panic and a system-wide denial of service. Red Hat rated this issue as Moderate (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No Red Hat Enterprise Linux or Red Hat In-Vehicle OS kernel, kernel-rt, or kernel-ivos-qualcomm variant is affected: none of the shipped Red Hat kernels contain the vulnerable code introduced by that upstream commit, as recorded in the "Vulnerable Code not Present" not-affected justification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.