CVE-2026-23361

What it actually does

Race between PCI posted write for MSI-X interrupt and outbound ATU unmap allows the write to be lost or misdirected, resulting in host memory corruption or IOMMU translation faults.

Why it matters to the business

Systems using Linux kernel PCI endpoint mode with MSI-X interrupts (storage targets, network devices, accelerators) can experience crashes, I/O failures, or data corruption; the issue has been public for over 200 days with slowly rising exploit probability.

How an attack unfolds

A local attacker with access to an affected endpoint driver invokes dw_pcie_ep_raise_msix_irq(), triggering a writel() that races with the subsequent ATU unmap; if the write loses the race the transaction faults or writes to an invalid address, observable as SMMU translation errors when driving high queue-depth workloads.

How to fix it

Apply the upstream fix that inserts a readl() flush of the MSI-X address before unmapping the ATU entry; rebuild and deploy the patched kernel on all affected systems; where immediate patching is impossible, reduce use of MSI-X vectors or limit endpoint driver exposure.

How to confirm the fix worked

Confirm the readl() flush is present in dw_pcie_ep_raise_msix_irq(); re-run the original fio workload that previously produced SMMU faults and verify absence of translation errors; monitor kernel logs for the arm-smmu-v3 fault signatures during high-queue-depth endpoint activity.

Typical attack path

1. Obtain local access or compromise a process that can exercise the PCI endpoint MSI-X path
2. Trigger repeated dw_pcie_ep_raise_msix_irq() calls under load (e.g., fio against nvmet-pci-epf)
3. Force the posted write to lose the race with ATU unmap, producing IOMMU faults or host memory corruption

How to detect it

Search kernel logs and dmesg for arm-smmu-v3 fault messages containing F_TRANSLATION, unpriv data write, and iova/ip a mismatch values around the time of high-queue-depth endpoint workloads; correlate with processes exercising dw_pcie_ep_raise_msix_irq paths.

What your security team should do

• Prioritize kernel updates on all hosts exposing PCI endpoint functions with MSI-X
• Add kernel log monitoring for arm-smmu-v3 translation faults and iova/ip a mismatch events
• Track EPSS trend and re-evaluate exploitability as the 30-day score continues to rise