# CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable()

Status: published. Published: 2026-05-08. Updated: 2026-11-06.

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: Fix race bug in nvme_poll_irqdisable()

In the following scenario, pdev can be disabled between (1) and (3) by
(2). This sets pdev->msix_enabled = 0. Then, pci_irq_vector() will
return MSI-X IRQ(>15) for (1) whereas return INTx IRQ(<=15) for (2).
This causes IRQ warning because it tries to enable INTx IRQ that has
never been disabled before.

To fix this, save IRQ number into a local variable and ensure
disable_irq() and enable_irq() operate on the same IRQ number.  Even if
pci_free_irq_vectors() frees the IRQ concurrently, disable_irq() and
enable_irq() on a stale IRQ number is still valid and safe, and the
depth accounting reamins balanced.

task 1:
nvme_poll_irqdisable()
  disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)) ...(1)
  enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector))  ...(3)

task 2:
nvme_reset_work()
  nvme_dev_disable()
    pdev->msix_enable = 0;  ...(2)

crash log:

------------[ cut here ]------------
Unbalanced enable for IRQ 10
WARNING: kernel/irq/manage.c:753 at __enable_irq+0x102/0x190 kernel/irq/manage.c:753, CPU#1: kworker/1:0H/26
Modules linked in:
CPU: 1 UID: 0 PID: 26 Comm: kworker/1:0H Not tainted 6.19.0-dirty #9 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Workqueue: kblockd blk_mq_timeout_work
RIP: 0010:__enable_irq+0x107/0x190 kernel/irq/manage.c:753
Code: ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 79 48 8d 3d 2e 7a 3f 05 41 8b 74 24 2c <67> 48 0f b9 3a e8 ef b9 21 00 5b 41 5c 5d e9 46 54 66 03 e8 e1 b9
RSP: 0018:ffffc900001bf550 EFLAGS: 00010046
RAX: 0000000000000007 RBX: 0000000000000000 RCX: ffffffffb20c0e90
RDX: 0000000000000000 RSI: 000000000000000a RDI: ffffffffb74b88f0
RBP: ffffc900001bf560 R08: ffff88800197cf00 R09: 0000000000000001
R10: 0000000000000003 R11: 0000000000000003 R12: ffff8880012a6000
R13: 1ffff92000037eae R14: 000000000000000a R15: 0000000000000293
FS:  0000000000000000(0000) GS:ffff8880b49f7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555da4a25fa8 CR3: 00000000208e8000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 enable_irq+0x121/0x1e0 kernel/irq/manage.c:797
 nvme_poll_irqdisable+0x162/0x1c0 drivers/nvme/host/pci.c:1494
 nvme_timeout+0x965/0x14b0 drivers/nvme/host/pci.c:1744
 blk_mq_rq_timed_out block/blk-mq.c:1653 [inline]
 blk_mq_handle_expired+0x227/0x2d0 block/blk-mq.c:1721
 bt_iter+0x2fc/0x3a0 block/blk-mq-tag.c:292
 __sbitmap_for_each_set include/linux/sbitmap.h:269 [inline]
 sbitmap_for_each_set include/linux/sbitmap.h:290 [inline]
 bt_for_each block/blk-mq-tag.c:324 [inline]
 blk_mq_queue_tag_busy_iter+0x969/0x1e80 block/blk-mq-tag.c:536
 blk_mq_timeout_work+0x627/0x870 block/blk-mq.c:1763
 process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x65c/0xe60 kernel/workqueue.c:3421
 kthread+0x41a/0x930 kernel/kthread.c:463
 ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
irq event stamp: 74478
hardirqs last  enabled at (74477): [<ffffffffb5720a9c>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last  enabled at (74477): [<ffffffffb5720a9c>] _raw_spin_unlock_irq+0x2c/0x60 kernel/locking/spinlock.c:202
hardirqs last disabled at (74478): [<ffffffffb57207b5>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (74478): [<ffffffffb57207b5>] _raw_spin_lock_irqsave+0x85/0xa0 kernel/locking/spinlock.c:162
softirqs last  enabled at (74304): [<ffffffffb1e9466c>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last  enabled at (74304): [<ffffffffb1e9466c>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last  enabled at (74304): [<ffffffffb1e9466c>] __irq_exit_rcu+0xdc/0x120
---truncated---

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/265dbc9bc33c29f60f90be3e0afe1c4067ebb70b
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/628773eba024d1107cc9ec157a682cbb42ac912a
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/843e913cef4e33723663a899727f685a95ab53fe
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/b56c49897bdac5cb49e3495ef421c391628ee9bb
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/e311d84c62eb76e025e11a44155b402e55950b83
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/fc71f409b22ca831a9f87a2712eaa09ef2bb4a5e

## Affected products and versions

- Linux / Linux: ≥ fa059b856a593a7bddd4d3779ae8ab1380e05d91; < 265dbc9bc33c29f60f90be3e0afe1c4067ebb70b (affected, git); ≥ fa059b856a593a7bddd4d3779ae8ab1380e05d91; < 628773eba024d1107cc9ec157a682cbb42ac912a (affected, git); ≥ fa059b856a593a7bddd4d3779ae8ab1380e05d91; < 843e913cef4e33723663a899727f685a95ab53fe (affected, git); ≥ fa059b856a593a7bddd4d3779ae8ab1380e05d91; < b56c49897bdac5cb49e3495ef421c391628ee9bb (affected, git); ≥ fa059b856a593a7bddd4d3779ae8ab1380e05d91; < e311d84c62eb76e025e11a44155b402e55950b83 (affected, git); ≥ fa059b856a593a7bddd4d3779ae8ab1380e05d91; < fc71f409b22ca831a9f87a2712eaa09ef2bb4a5e (affected, git). Source: CNA: Linux
- Linux / Linux: 5.7 (affected); ≥ 0; < 5.7 (unaffected, semver); ≥ 6.1.167; ≤ 6.1.* (unaffected, semver); ≥ 6.6.130; ≤ 6.6.* (unaffected, semver); ≥ 6.12.78; ≤ 6.12.* (unaffected, semver); ≥ 6.18.19; ≤ 6.18.* (unaffected, semver); ≥ 6.19.9; ≤ 6.19.* (unaffected, semver); ≥ 7.0; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.1.167",
            "versionStartIncluding": "5.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.6.130",
            "versionStartIncluding": "6.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.12.78",
            "versionStartIncluding": "6.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.18.19",
            "versionStartIncluding": "6.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.19.9",
            "versionStartIncluding": "6.19",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 3.1: 4.7 (medium); CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H; source: NVD: nvd@nist.gov

- CISA KEV: No listing in collected sources

- EPSS: 0.09% as of 2026-11-06; percentile 0.41%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-362

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/265dbc9bc33c29f60f90be3e0afe1c4067ebb70b (CNA: Linux)

- https://git.kernel.org/stable/c/628773eba024d1107cc9ec157a682cbb42ac912a (CNA: Linux)

- https://git.kernel.org/stable/c/843e913cef4e33723663a899727f685a95ab53fe (CNA: Linux)

- https://git.kernel.org/stable/c/b56c49897bdac5cb49e3495ef421c391628ee9bb (CNA: Linux)

- https://git.kernel.org/stable/c/e311d84c62eb76e025e11a44155b402e55950b83 (CNA: Linux)

- https://git.kernel.org/stable/c/fc71f409b22ca831a9f87a2712eaa09ef2bb4a5e (CNA: Linux)

- https://git.kernel.org/stable/c/265dbc9bc33c29f60f90be3e0afe1c4067ebb70b (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/628773eba024d1107cc9ec157a682cbb42ac912a (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/843e913cef4e33723663a899727f685a95ab53fe (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/b56c49897bdac5cb49e3495ef421c391628ee9bb (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/e311d84c62eb76e025e11a44155b402e55950b83 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/fc71f409b22ca831a9f87a2712eaa09ef2bb4a5e (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-43448; retrieved 2026-11-06; source updated 2026-11-06

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-43448; retrieved 2026-11-06; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-43448; retrieved 2026-11-06; source updated Not reported

Revision: 68506d3ddc88390000dc021c12ad730f5f666ea69b10cff687c96199ac4245a6

Canonical: https://y2.dev/cve/CVE-2026-43448

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.