Vulnerability-Lookup

FKIE_CVE-2026-90332

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-18 18:17

Severity

8.2 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush cached MSI write before unmapping the iATU The MSI-X path already flushes any posted MSI-X write before tearing down its iATU mapping. That was added by commit c22533c66cca ("PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry") to make sure the write reaches the Root Complex before the outbound window that translates it disappears. The MSI path has the same problem but no equivalent flush. When the Endpoint driver caches an MSI target address and later observes that the Root Complex has changed it, dw_pcie_ep_raise_msi_irq() unmaps the existing iATU entry and reprograms it for the new address. Between the last MSI writel() and the unmap there may still be a posted write sitting in the fabric, and unmapping the iATU entry can drop or misroute that write. Fix this by reading back from the mapped MSI window before the unmap. The readback drains any posted MSI writes through the same iATU entry that mapped them, which is the same logic the MSI-X path uses. [mani: commit log]

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1b01d725d8b42450b86a857bab3c46856c740166
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/914704c7b318bdaa42dce4e55f6c492190fee3b5

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/controller/dwc/pcie-designware-ep.c",
            "drivers/pci/controller/dwc/pcie-designware.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "914704c7b318bdaa42dce4e55f6c492190fee3b5",
              "status": "affected",
              "version": "468711a40d5dfc01bf0a24c1981246a2c93ac405",
              "versionType": "git"
            },
            {
              "lessThan": "1b01d725d8b42450b86a857bab3c46856c740166",
              "status": "affected",
              "version": "468711a40d5dfc01bf0a24c1981246a2c93ac405",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cc83cd7b7d73d42ee64c7fc08ce679957df0f315",
              "versionType": "git"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/controller/dwc/pcie-designware-ep.c",
            "drivers/pci/controller/dwc/pcie-designware.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Flush cached MSI write before unmapping the iATU\n\nThe MSI-X path already flushes any posted MSI-X write before tearing down\nits iATU mapping. That was added by commit c22533c66cca (\"PCI: dwc: ep:\nFlush MSI-X write before unmapping its ATU entry\") to make sure the write\nreaches the Root Complex before the outbound window that translates it\ndisappears.\n\nThe MSI path has the same problem but no equivalent flush. When the\nEndpoint driver caches an MSI target address and later observes that the\nRoot Complex has changed it, dw_pcie_ep_raise_msi_irq() unmaps the existing\niATU entry and reprograms it for the new address. Between the last MSI\nwritel() and the unmap there may still be a posted write sitting in the\nfabric, and unmapping the iATU entry can drop or misroute that write.\n\nFix this by reading back from the mapped MSI window before the unmap. The\nreadback drains any posted MSI writes through the same iATU entry that\nmapped them, which is the same logic the MSI-X path uses.\n\n[mani: commit log]"
    }
  ],
  "id": "CVE-2026-90332",
  "lastModified": "2026-09-18T18:17:54.450",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-17T17:17:31.720",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1b01d725d8b42450b86a857bab3c46856c740166"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/914704c7b318bdaa42dce4e55f6c492190fee3b5"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-90332 (GCVE-0-2026-90332)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:08 – Updated: 2026-09-18 17:54

Title

PCI: dwc: ep: Flush cached MSI write before unmapping the iATU

Summary

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/914704c7b318bdaa4…
https://git.kernel.org/stable/c/1b01d725d8b42450b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 468711a40d5dfc01bf0a24c1981246a2c93ac405 , < 914704c7b318bdaa42dce4e55f6c492190fee3b5 (git) Affected: 468711a40d5dfc01bf0a24c1981246a2c93ac405 , < 1b01d725d8b42450b86a857bab3c46856c740166 (git) Affected: cc83cd7b7d73d42ee64c7fc08ce679957df0f315 (git) Affected: 6.19.7 , < 6.20 (semver)
Linux	Linux	Affected: 7.0 Unaffected: 0 , < 7.0 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/controller/dwc/pcie-designware-ep.c",
            "drivers/pci/controller/dwc/pcie-designware.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "914704c7b318bdaa42dce4e55f6c492190fee3b5",
              "status": "affected",
              "version": "468711a40d5dfc01bf0a24c1981246a2c93ac405",
              "versionType": "git"
            },
            {
              "lessThan": "1b01d725d8b42450b86a857bab3c46856c740166",
              "status": "affected",
              "version": "468711a40d5dfc01bf0a24c1981246a2c93ac405",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cc83cd7b7d73d42ee64c7fc08ce679957df0f315",
              "versionType": "git"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/controller/dwc/pcie-designware-ep.c",
            "drivers/pci/controller/dwc/pcie-designware.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Flush cached MSI write before unmapping the iATU\n\nThe MSI-X path already flushes any posted MSI-X write before tearing down\nits iATU mapping. That was added by commit c22533c66cca (\"PCI: dwc: ep:\nFlush MSI-X write before unmapping its ATU entry\") to make sure the write\nreaches the Root Complex before the outbound window that translates it\ndisappears.\n\nThe MSI path has the same problem but no equivalent flush. When the\nEndpoint driver caches an MSI target address and later observes that the\nRoot Complex has changed it, dw_pcie_ep_raise_msi_irq() unmaps the existing\niATU entry and reprograms it for the new address. Between the last MSI\nwritel() and the unmap there may still be a posted write sitting in the\nfabric, and unmapping the iATU entry can drop or misroute that write.\n\nFix this by reading back from the mapped MSI window before the unmap. The\nreadback drains any posted MSI writes through the same iATU entry that\nmapped them, which is the same logic the MSI-X path uses.\n\n[mani: commit log]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - dw_pcie_ep_raise_msi_irq() unmaps when DBI PCI_MSI_ADDRESS_LO/HI (programmed by a Root Complex CfgWr) no longer matches ep-\u003emsi_msg_addr; the following raise is pci_epc_raise_irq() from nvmet_pci_epf_raise_irq() after an NVMe CQ post or pci_epf_test_cmd_handler() on COMMAND_RAISE_MSI_IRQ, i.e. MMIO from a connected PCIe peer, not routed IP and not an EP-local syscall.\nAC:L - The RC can CfgWr a new Message Address and immediately doorbell another NVMe command or COMMAND_RAISE_MSI_IRQ so the next dw_pcie_ep_raise_msi_irq() takes the unmap path; both the address change and the IRQ-raising traffic are attacker-driven, and the same in-flight posted write was hit with fio against nvmet-pci-epf on the MSI-X path.\nPR:N - CfgWr to the MSI capability is applied in hardware to DBI with no EP Linux uid or capability check, and nvmet_pci_epf_cq_work()/pci_epf_test_cmd_handler() honor host doorbells and BAR commands without authentication on the endpoint.\nUI:N - nvmet_pci_epf_cq_work() and pci_epf_test_cmd_handler() run from endpoint workqueues solely in response to host MMIO; no operator on the EP must mount a filesystem or open a device node to reach dw_pcie_ep_raise_msi_irq().\nS:C - dw_pcie_ep_unmap_addr() clears the outbound iATU window that translates the MSI writel into a host Memory Write; a posted write that loses that race can be misrouted off the host MSI doorbell page (the MSI-X sibling documented host memory corruption and arm-smmu-v3 F_TRANSLATION), crossing the EP-to-host DMA translation boundary.\nC:N - The in-flight operation is writel(msg_data | (interrupt_num-1), ep-\u003emsi_mem + offset), a 32-bit posted MSI doorbell store; the bug does not read EP kernel memory or host buffers.\nI:L - A misrouted MSI writel can store 32 bits of (PCI_MSI_DATA_* | vector) through a torn outbound iATU into host memory, which is a limited modification, not an arbitrary EP-kernel write or control-flow hijack.\nA:H - Dropping the posted MSI write loses the host interrupt, and this function\u0027s comment states that reprogramming iATU with AXI operations in flight is unsafe, which can stall dw_pcie_ep_map_addr()/writel() on the outbound bridge; the MSI-X counterpart produced arm-smmu-v3 F_TRANSLATION under nvmet-pci-epf fio, denying further MSI delivery until reset."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:42.618Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/914704c7b318bdaa42dce4e55f6c492190fee3b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b01d725d8b42450b86a857bab3c46856c740166"
        }
      ],
      "title": "PCI: dwc: ep: Flush cached MSI write before unmapping the iATU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90332",
    "datePublished": "2026-09-17T16:08:46.154Z",
    "dateReserved": "2026-09-11T19:38:34.803Z",
    "dateUpdated": "2026-09-18T17:54:42.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-90332

CVE-2026-90332 (GCVE-0-2026-90332)

Tags

Sightings

Nomenclature

Related by attack behaviour