# CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry CVE-2026-23361 is fixed in 37 products on 1 platform, first by DEBIAN-CVE-2026-23361, released March 25, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-23361 - Priority: High - CVSS: 7.8 (Important) - EPSS: 0.0017 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 25, 2026 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23361 ## Description In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X interrupt to the host using a writel(), which generates a PCI posted write transaction. There's no completion for posted writes, so the writel() may return before the PCI write completes. dw_pcie_ep_raise_msix_irq() also unmaps the outbound ATU entry used for the PCI write, so the write races with the unmap. If the PCI write loses the race with the ATU unmap, the write may corrupt host memory or cause IOMMU errors, e.g., these when running fio with a larger queue depth against nvmet-pci-epf: arm-smmu-v3 fc900000.iommu: 0x0000010000000010 arm-smmu-v3 fc900000.iommu: 0x0000020000000000 arm-smmu-v3 fc900000.iommu: 0x000000090000f040 arm-smmu-v3 fc900000.iommu: 0x0000000000000000 arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION client: 0000:01:00.0 sid: 0x100 ssid: 0x0 iova: 0x90000f040 ipa: 0x0 arm-smmu-v3 fc900000.iommu: unpriv data write s1 "Input address caused fault" stag: 0x0 Flush the write by performing a readl() of the same address to ensure that the write has reached the destination before the ATU entry is unmapped. The same problem was solved for dw_pcie_ep_raise_msi_irq() in commit 8719c64e76bf ("PCI: dwc: ep: Cache MSI outbound iATU mapping"), but there it was solved by dedicating an outbound iATU only for MSI. We can't do the same for MSI-X because each vector can have a different msg_addr and the msg_addr may be changed while the vector is masked. [bhelgaas: commit log] ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bpftool6.12 amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | bpftool6.12-debuginfo amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | dtb-aarch64 opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel-64kb opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel-azure opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel-default opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel-default-base opensuse-leap 16.0 | 6.12.0-160000.27.1.160000.2.8 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel-docs opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel-kvmsmall opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel-livepatch-6.12.77-99.140 amzn 2023 | 1:1.0-0.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel-livepatch-SLE15-SP7-RT_Update_11 sles 15.7 | 1-150700.1.3.1 | [SUSE-SU-2026:1573-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1573-1.md) | Apr 23, 2026 | | Linux | kernel-obs-build opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel-obs-qa opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel-rt opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel-source opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel-syms opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel-zfcpdump opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 | | Linux | kernel6.12 amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-debuginfo amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-debuginfo-common-aarch64 amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-debuginfo-common-x86_64 amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-devel amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-headers amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-libbpf amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-libbpf-debuginfo amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-libbpf-devel amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-libbpf-static amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-modules-extra amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-modules-extra-common amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-tools amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-tools-debuginfo amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | kernel6.12-tools-devel amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | linux Debian 13.5 (trixie) | 6.12.85-1 | [DEBIAN-CVE-2026-23361](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23361.md) | Mar 25, 2026 | | Linux | linux Debian 14 | 6.19.8-1 | [DEBIAN-CVE-2026-23361](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23361.md) | Mar 25, 2026 | | Linux | perf6.12 amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | perf6.12-debuginfo amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | python3-perf6.12 amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | | Linux | python3-perf6.12-debuginfo amzn 2023 | 1:6.12.77-99.140.amzn2023 | [ALAS2023-2026-1543](https://patchblox.com/security/data/fix/linux/alas2023-2026-1543.md) | Apr 7, 2026 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.