CVE-2026-90332

A flaw was found in the Linux kernel's PCI dwc endpoint driver. This vulnerability occurs when the driver unmaps an Inbound Address Translation Unit (iATU) entry without ensuring that all pending Message Signaled Interrupts (MSI) writes have been flushed. This can lead to MSI writes being dropped or misrouted, potentially causing system instability or data integrity issues.

A moderate impact flaw was found in the Linux kernel PCI DesignWare (dwc) endpoint driver. When the endpoint driver has cached an MSI target address and later observes that the Root Complex has changed it, dw_pcie_ep_raise_msi_irq() unmaps the existing iATU (Inbound Address Translation Unit) translation entry and reprograms it for the new address without first draining any posted MSI write that may still be in flight in the fabric. Unmapping the iATU entry can cause such a pending MSI write to be dropped or misrouted, resulting in lost interrupts and potential system instability or data integrity issues. Red Hat assessed this flaw as Moderate severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the upstream CVE.org rating of Important (8.2) because Red Hat scored the attack vector as local with unchanged scope, while the upstream record assumes an adjacent attack vector with cross-scope integrity impact. Red Hat Enterprise Linux, including the kernel and kernel-rt packages, is not affected because the vulnerable code is not present in those builds. The affected products are Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm components) and the OpenShift Container Platform RHEL CoreOS kernel, for which the fix is currently deferred. The residual risk on the affected products is limited to dropped or misrouted MSI writes from a PCI endpoint function when the Root Complex changes the cached MSI target address, which may lead to device malfunction or system instability rather than privilege escalation or information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.