CVE-2026-23361: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23361 is a time-of-check time-of-use (TOCTOU) race condition in the Linux kernel's PCI DesignWare (dwc) endpoint driver, specifically in the dw_pcie_ep_raise_msix_irq() function. The vulnerability affects Linux kernel versions from 4.19.1 up to (but not including) 6.12.77, 6.13 up to 6.18.17, and 6.19 up to 6.19.7, as well as 7.0 release candidates. It was disclosed on March 25, 2026, with patches published to the stable kernel tree in April 2026. The CVSS v3.1 base score is 7.8 (High), requiring local access with low privileges (Red Hat CVE, Red Hat Bugzilla).

The root cause is a TOCTOU race condition (CWE-367) combined with a potential out-of-bounds write (CWE-787) in the dw_pcie_ep_raise_msix_irq() function. When an endpoint driver raises an MSI-X interrupt to the host via writel(), it generates a PCI posted write transaction — a fire-and-forget operation with no completion acknowledgment — meaning writel() may return before the write reaches the destination. The function then immediately unmaps the outbound ATU (Address Translation Unit) entry used for that write, creating a window where the in-flight PCI write may be redirected to an unmapped or incorrect memory region. The fix involves inserting a readl() of the same address after the writel() to flush the write and ensure it completes before the ATU entry is unmapped — analogous to the fix applied to dw_pcie_ep_raise_msi_irq() in commit 8719c64e76bf (Red Hat Bugzilla, Red Hat CVE).

If the PCI write loses the race with the ATU unmap, the write may corrupt host memory or trigger IOMMU translation faults, as observed with arm-smmu-v3 reporting F_TRANSLATION events and "Input address caused fault" errors. These conditions are most likely to manifest during I/O-intensive workloads at higher queue depths, such as when using NVMe endpoint functions (nvmet-pci-epf) with tools like fio. The practical consequences include data corruption and denial of service (system instability), with confidentiality, integrity, and availability all rated as high impact (Red Hat Bugzilla, Red Hat CVE).

• Logs: arm-smmu-v3 IOMMU error messages in the kernel log, specifically event: F_TRANSLATION with client 0000:01:00.0 and unpriv data write s1 "Input address caused fault" entries.
• Logs: Repeated IOMMU fault events referencing unexpected IOVA addresses (e.g., iova: 0x90000f040 ipa: 0x0) during high-throughput PCI endpoint I/O operations.
• System Behavior: Unexpected system instability, kernel panics, or data corruption observed during I/O-intensive workloads involving NVMe endpoint functions (nvmet-pci-epf) at higher queue depths (Red Hat Bugzilla).

Apply the available Linux kernel patches for the affected stable branches: kernel versions 6.12.77+, 6.18.17+, and 6.19.7+ contain the fix. Patches are available via the stable kernel tree at git.kernel.org. As a temporary workaround where immediate patching is not possible, reducing I/O queue depths on systems using PCI endpoint drivers with MSI-X interrupts (e.g., nvmet-pci-epf) can reduce the likelihood of triggering the race condition, though this does not fully eliminate the risk. Red Hat tracks this issue in Bugzilla and CVE advisories; downstream distributions including SUSE and Amazon Linux 2023 have also issued advisories (Red Hat CVE, Red Hat Bugzilla, SUSE Advisory, Amazon Linux).

Red Hat tracked the vulnerability through its standard CVE advisory process and filed a Bugzilla entry on March 25, 2026. SUSE issued security update announcements (SUSE-SU-2026:1661-1 and SUSE-SU-2026:21241-1) for affected kernel packages. Amazon Linux 2023 also published an advisory (ALAS2023-2026-1543). The Yocto Project security mailing list flagged the issue for embedded Linux maintainers. No notable independent researcher commentary or significant social media discussion has been identified (SUSE Advisory, Amazon Linux).