CVE-2026-23361 Linux CVE debrief

Who should care

Linux system administrators and security teams should assess exposure and prioritize patching vulnerable kernel versions. They should also verify patch application, inventory Linux systems for affected kernel versions, and monitor for IOMMU errors. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should prioritize patching vulnerable Linux kernel versions to prevent potential host memory corruption or IOMMU errors. Linux system administrators and security teams should assess exposure, verify patch application, and inventory Linux systems for affected kernel versions.

• Potential host memory corruption
• Potential IOMMU errors requiring system reboot
• Verification of patch application required
• Inventory of Linux systems for affected kernel versions necessary

Technical summary

The Linux kernel's PCI endpoint driver has a vulnerability that can cause host memory corruption or IOMMU errors due to a race condition between writing to an MSI-X interrupt and unmapping its ATU entry. The vulnerability arises from the use of a writel() function to raise an MSI-X interrupt, which generates a PCI posted write transaction. If the PCI write loses the race with the ATU unmap, the write may corrupt host memory or cause IOMMU errors. To address this issue, a readl() operation is performed on the same address to ensure that the write has reached the destination before the ATU entry is unmapped.

Defensive priority

Defenders should prioritize patching vulnerable Linux kernel versions to prevent potential host memory corruption or IOMMU errors.

Recommended defensive actions

• Patch vulnerable Linux kernel versions
• Inventory Linux systems for affected kernel versions
• Monitor for IOMMU errors
• Verify patch application
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is described in the Linux kernel's official repository. Multiple patches have been applied to address this issue. The Linux kernel maintainers have backported fixes to stable kernel versions. The vulnerability was publicly disclosed on March 25, 2026. There are reports of IOMMU errors and potential memory corruption on systems running vulnerable kernel versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.