CVE-2026-64430

NTB: epf: Avoid calling pci_irq_vector() from hardirq context

State: Published
Severity: 7.5 High
Published: Jul 25, 2026
Updated: Aug 17, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

NTB: epf: Avoid calling pci_irq_vector() from hardirq context

ntb_epf_vec_isr() calls pci_irq_vector() in hardirq context to derive the vector number. pci_irq_vector() calls msi_get_virq() that takes a mutex and can therefore trigger "scheduling while atomic" splats:

BUG: scheduling while atomic: kworker/u33:0/55/0x00010001 ... Call trace: ... schedule+0x38/0x110 schedule_preempt_disabled+0x28/0x50 __mutex_lock.constprop.0+0x848/0x908 __mutex_lock_slowpath+0x18/0x30 mutex_lock+0x4c/0x60 msi_domain_get_virq+0xe8/0x138 pci_irq_vector+0x2c/0x60 ntb_epf_vec_isr+0x28/0x120 [ntb_hw_epf] __handle_irq_event_percpu+0x70/0x3a8 handle_irq_event+0x48/0x100 handle_edge_irq+0x100/0x1c8 ...

Cache the Linux IRQ number for vector 0 when vectors are allocated and use it as a base in the ISR. Running the ISR in a threaded IRQ handler would also avoid the problem, but that would be unnecessary here.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before 33bba331a4a5fee8b6026fe72eca13cceeec1b7bAffected 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before aff271b12a1eb8c8b3da19223ae1a6abe1e8168bAffected 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before 1dba8444ac0100133d72374634f6d7451fff1cccAffected 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before 174a97f21bf9c54fa37ec0f321692e862ea130a3Affected 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before f71e8d9875069fa73e335f63f02ec6e52e3aaa51Affected 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before 6350df503897d57c5634f71b0767d48c3b837583Affected 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before 4dcddc1c794d1c65eda68f1f8dd04a0fecc0870fAffected
LinuxLinux	5.12Affected before 5.12Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before 33bba331a4a5fee8b6026fe72eca13cceeec1b7bAffected
812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before aff271b12a1eb8c8b3da19223ae1a6abe1e8168bAffected
812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before 1dba8444ac0100133d72374634f6d7451fff1cccAffected
812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before 174a97f21bf9c54fa37ec0f321692e862ea130a3Affected
812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before f71e8d9875069fa73e335f63f02ec6e52e3aaa51Affected
812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before 6350df503897d57c5634f71b0767d48c3b837583Affected
812ce2f8d14ea791edd88c36ebcc9017bf4c88cb to before 4dcddc1c794d1c65eda68f1f8dd04a0fecc0870fAffected

LinuxLinux

5.12Affected
before 5.12Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.