SECUFOCUSNOW
Home›CVE index›CVE-2026-64430
Review reviewHigh

CVE-2026-64430

Linux

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pci_irq_vector() from hardirq context ntb_epf_vec_isr() calls pci_irq_vector() in hardirq context to derive the vector number. pci_irq_vector() calls msi_get_virq() that takes a mutex and can therefore trigger "scheduling while atomic" splats: BUG: scheduling while atomic: kworker/u33:0/55/0x00010001 ... Call trace: ... schedule+0x38/0x110 schedule_preempt_disabled+0x28/0x50 __mutex_lock.constprop.0+0x848/0x908 __mutex_lock_slowpath+0x18/0x30 mutex_lock+0x4c/0x60 msi_domain_get_virq+0xe8/0x138 pci_ir...

CVSS
7.5
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.5

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pci_irq_vector() from hardirq context ntb_epf_vec_isr() calls pci_irq_vector() in hardirq context to derive the vector number. pci_irq_vector() calls msi_get_virq() that takes a mutex and can therefore trigger "scheduling while atomic" splats: BUG: scheduling while atomic: kworker/u33:0/55/0x00010001 ... Call trace: ... schedule+0x38/0x110 schedule_preempt_disabled+0x28/0x50 __mutex_lock.constprop.0+0x848/0x908 __mutex_lock_slowpath+0x18/0x30 mutex_lock+0x4c/0x60 msi_domain_get_virq+0xe8/0x138 pci_ir...

Affected product and versions

Product
Linux
Affected versions
>= 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb < 33bba331a4a5fee8b6026fe72eca13cceeec1b7b, >= 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb < aff271b12a1eb8c8b3da19223ae1a6abe1e8168b, >= 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb < 1dba8444ac0100133d72374634f6d7451fff1ccc, >= 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb < 174a97f21bf9c54fa37ec0f321692e862ea130a3, >= 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb < f71e8d9875069fa73e335f63f02ec6e52e3aaa51, >= 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb < 6350df503897d57c5634f71b0767d48c3b837583, >= 812ce2f8d14ea791edd88c36ebcc9017bf4c88cb < 4dcddc1c794d1c65eda68f1f8dd04a0fecc0870f, >= 5.12
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
Not available
CVE-2026-64430 — Linux | SECUFOCUS NOW