What is the CVSS score of EUVD-2026-15340?

EUVD-2026-15340 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-15340?

Yes, a patch is available for EUVD-2026-15340. Update the affected software to the latest version immediately.

Linux EUVD-2026-15340

| CVE-2026-23361 HIGH

Out-of-bounds Write (CWE-787)

2026-03-25 Linux

GHSA-7vjw-7j3v-c8gx

Buffer Overflow Linux Memory Corruption

7.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	This vulnerability represents a moderate to high real-world risk despite the lack of assigned CVSS and EPSS scores. The vulnerability requires local access or control over a PCI endpoint device to trigger, limiting exploitation scope compared to remote network vulnerabilities. However, the impact is significant: confirmed IOMMU faults were observed during normal operation (fio testing against nvmet-pci-epf with higher queue depths), demonstrating the vulnerability is triggerable without sophisticated exploit conditions. The race condition is timing-dependent but highly probable under load, making it reliably exploitable by endpoint driver implementations or malicious firmware. The vulnerability is not listed as actively exploited in KEV but represents a critical stability issue for systems using PCI endpoint functionality. Multiple stable kernel patches are available (evidenced by four reference commits across stable branches), indicating maintainers prioritized rapid distribution.
Exploit ScenarioDerived	An attacker with control over a malicious PCI endpoint device (or firmware running on a legitimate endpoint) could deliberately generate high-frequency MSI-X interrupts (as occurs naturally during high queue-depth I/O operations like the fio test case). By timing interrupt generation to align with the ATU unmap operation, the posted write carrying the interrupt message can complete after the ATU entry is unmapped, causing the write to land on unmapped host physical memory. This results in host IOMMU faults (as observed: arm-smmu-v3 F_TRANSLATION errors) or potential host memory corruption if IOMMU protection is disabled. The attack requires physical PCI device access or control of endpoint firmware, but the timing window is naturally hit during normal high-throughput workloads, making this a reliability issue as much as a security concern.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

This vulnerability is a race condition in the Linux kernel's PCI Designware endpoint driver where MSI-X interrupt writes to the host can complete after the corresponding Address Translation Unit (ATU) entry is unmapped, potentially corrupting host memory or triggering IOMMU errors. The vulnerability affects all Linux kernel versions with the vulnerable code path in the PCI DWC endpoint implementation (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*), specifically impacting systems using PCI endpoint devices with MSI-X interrupt support such as NVMe-PCI endpoint function drivers. An attacker with the ability to trigger high-frequency MSI-X interrupts from a malicious endpoint device could exploit this race condition to cause denial of service through IOMMU faults or potentially corrupt host memory.

RemediationAI

Apply the latest Linux kernel patch from the stable branches containing the fix (references: https://git.kernel.org/stable/c/a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0, https://git.kernel.org/stable/c/6f60a783860c77b309f7d81003b6a0c73feca49e, https://git.kernel.org/stable/c/eaa6a56801ddd2d9b4980f19e7fe002b00994804, https://git.kernel.org/stable/c/c22533c66ccae10511ad6a7afc34bb26c47577e3). Immediately upgrade to a patched kernel version for any system utilizing PCI endpoint functionality. If immediate patching is not feasible, reduce MSI-X interrupt frequency or queue depth to lower the probability of the race condition triggering. For systems running nvmet-pci-epf or similar endpoint drivers, prioritize kernel updates as these workloads are most likely to trigger the vulnerability through high-frequency interrupt generation.

Affected VersionsENISA

Linux beb4641a787df79a1423a8789d185b6b78fcbfea <c22533c66ccae10511ad6a7afc34bb26c47577e3

Linux patch: 7.0-rc2

Linux 4.19

Linux beb4641a787df79a1423a8789d185b6b78fcbfea <6f60a783860c77b309f7d81003b6a0c73feca49e

Linux beb4641a787df79a1423a8789d185b6b78fcbfea <eaa6a56801ddd2d9b4980f19e7fe002b00994804

Linux patch: 6.18.17

Linux patch: 6.19.7

Linux patch: 6.12.77

Linux patch: 0

Linux beb4641a787df79a1423a8789d185b6b78fcbfea <a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the Designware PCI controller's endpoint mode implementation, specifically in the dw_pcie_ep_raise_msix_irq() function responsible for raising MSI-X interrupts from endpoint devices to the host. PCI posted write transactions do not guarantee completion before the issuing instruction returns, creating a window where a writel() operation may still be in flight when the driver unmaps the outbound ATU entry used to translate the write. The root cause is a synchronization issue between the PCI write operation and the ATU resource cleanup, classified as improper synchronization or timing-dependent vulnerability. The affected CPE (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) indicates all Linux kernel versions are potentially vulnerable until patched. The fix involves adding a readl() barrier after the writel() to ensure the posted write completes before ATU unmap, similar to the approach previously applied to MSI handling in commit 8719c64e76bf.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE 5.2 MEDIUM

Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 24, 2026 - 18:52 NVD

7.8 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 25, 2026 - 10:27 nvd

N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry

Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X interrupt to the host using a writel(), which generates a PCI posted write transaction. There's no completion for posted writes, so the writel() may return before the PCI write completes. dw_pcie_ep_raise_msix_irq() also unmaps the outbound ATU entry used for the PCI write, so the write races with the unmap.

If the PCI write loses the race with the ATU unmap, the write may corrupt host memory or cause IOMMU errors, e.g., these when running fio with a larger queue depth against nvmet-pci-epf:

arm-smmu-v3 fc900000.iommu: 0x0000010000000010 arm-smmu-v3 fc900000.iommu: 0x0000020000000000 arm-smmu-v3 fc900000.iommu: 0x000000090000f040 arm-smmu-v3 fc900000.iommu: 0x0000000000000000 arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION client: 0000:01:00.0 sid: 0x100 ssid: 0x0 iova: 0x90000f040 ipa: 0x0 arm-smmu-v3 fc900000.iommu: unpriv data write s1 "Input address caused fault" stag: 0x0

Flush the write by performing a readl() of the same address to ensure that the write has reached the destination before the ATU entry is unmapped.

The same problem was solved for dw_pcie_ep_raise_msi_irq() in commit 8719c64e76bf ("PCI: dwc: ep: Cache MSI outbound iATU mapping"), but there it was solved by dedicating an outbound iATU only for MSI. We can't do the same for MSI-X because each vector can have a different msg_addr and the msg_addr may be changed while the vector is masked.

[bhelgaas: commit log]

Threat Intelligence Overview

EPSS Score

0.0%

Top 96% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2012-1889 HIGH POC

8.8

CVE-2010-3333 HIGH POC

7.8

CVE-2014-1761 HIGH POC

7.8

CVE-2009-3129 HIGH POC

7.8

CVE-2021-1732 HIGH POC

7.8

CVE-2013-3346 CRITICAL POC

9.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	5.10.223-1	-
bullseye (security)	vulnerable	5.10.251-1	-
bookworm	vulnerable	6.1.159-1	-
bookworm (security)	vulnerable	6.1.164-1	-
trixie	vulnerable	6.12.73-1	-
trixie (security)	vulnerable	6.12.74-2	-
forky, sid	fixed	6.19.8-1	-
(unstable)	fixed	6.19.8-1	-

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23361 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/?id.353047 REF https://git.kernel.org/stable/c/1d35fc94cd723ae27371a31f404685a24b097d71 REF https://git.kernel.org/stable/c/5e2fc90018635fc982d39f8c11cd3b368fdaf3b7 REF https://git.kernel.org/stable/c/6f60a783860c77b309f7d81003b6a0c73feca49e REF https://git.kernel.org/stable/c/a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0 REF https://git.kernel.org/stable/c/c22533c66ccae10511ad6a7afc34bb26c47577e3 REF https://git.kernel.org/stable/c/eaa6a56801ddd2d9b4980f19e7fe002b00994804

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back