What’s Vulnerable › Vulnerabilities

CVE-2026-53067: PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-24 · updated 2026-07-21
• Weakness: CWE-415

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc pci_epf_alloc_doorbell() stores the allocated doorbell message array in epf->db_msg/epf->num_db before requesting MSI vectors. If MSI allocation fails, the array is freed but the EPF state may still point to freed memory. Clear epf->db_msg and epf->num_db on the MSI allocation failure path so that later cleanup cannot double-free the array and callers can retry allocation. Also return -EBUSY when doorbells have already been allocated to prevent leaking or overwriting an existing allocation.

Affected products

• Linux kernel: from 6.17 before 6.18.33; from 6.19 before 7.0.10 — fixed in 6.18.33, 7.0.10

How to fix

Upgrade to a fixed version: Linux kernel 6.18.33, 7.0.10. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/175717cfc06cab79f84cd037d66dda1b8564cd9e
• https://git.kernel.org/stable/c/1cba96c0a795124c3229293ed7b5b5765e66f259
• https://git.kernel.org/stable/c/3c25587fbf8797b92090b064a6d239a873e55fb1

Get alerted when CVE-2026-53067 or the next vulnerability affects your stack