CVE-2026-89722 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()
pci_write_legacy_io() loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote:
if (count != 1 && count != 2 && count != 4) return -EINVAL;
return pci_legacy_write(bus, off, *(u32 *)buf, count);
kernfs_fop_write_iter() allocates the buffer with kmalloc(len + 1), so a 1-byte write to the legacy_io sysfs file allocates 2 bytes and the unconditional u32 load reads up to 2 bytes past the end of the allocation, which KASAN reports as a slab-out-of-bounds read. Similarly, a 2-byte write overreads by 1 byte.
Thus, read only the number of bytes requested using get_unaligned_le16() and get_unaligned_le32() for the 2 and 4 byte cases, interpreting the buffer as little-endian to match the byte ordering of PCI I/O port space.
The PowerPC implementation previously compensated for the generic code's native-endian 32-bit load by shifting the value into place for the 1 and 2 byte cases. The shifts were only correct on big-endian kernels.
On little-endian PowerPC (POWER8 and later), they extracted the wrong bytes, so a 1-byte write wrote an out-of-bounds byte instead of the requested value. On big-endian, the native load also caused out_le16() and out_le32() to reverse the user's bytes on the wire for 2 and 4 byte writes. The little-endian helpers resolve both issues, so the shifts are removed.
No changes are needed for the Alpha platform.
The legacy_io file is root-only and exists only on Alpha and PowerPC, the two architectures that define HAVE_PCI_LEGACY.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in the Linux kernel involves an out-of-bounds read within the pci_write_legacy_io function located in the PCI subsystem's sysfs interface. This flaw arises from a fundamental mismatch between how user-space writes data to the legacy_io file and how the kernel processes that input for hardware register updates. Specifically, the original implementation unconditionally loads four bytes from the kernfs write buffer using a standard 32-bit pointer cast, regardless of whether the user requested a one-byte or two-byte operation. Although the code validates that the count is either one, two, or four bytes before proceeding, it fails to respect this constraint during the actual data extraction phase. This discrepancy leads to memory safety violations where the kernel reads beyond the allocated buffer boundaries when smaller write sizes are used.
The technical root cause lies in the interaction between kernfs_fop_write_iter and pci_write_legacy_io. The file system layer allocates a buffer sized as len plus one byte, ensuring there is always at least one extra byte available for null termination or safety padding. However, when a user writes only one byte to this file, the kernel still attempts to read four bytes into a 32-bit integer variable. This results in reading up to two bytes past the end of the valid data region allocated by kernfs. Similarly, a two-byte write causes an overread of one byte beyond the intended scope. These actions trigger slab-out-of-bounds read errors as detected by Kernel Address Sanitizer (KASAN), indicating that the kernel is accessing memory it does not own or should not access in this context.
From a security perspective, while the legacy_io sysfs file is restricted to root privileges and exists only on Alpha and PowerPC architectures under HAVE_PCI_LEGACY configurations, out-of-bounds reads remain critical vulnerabilities. They can potentially lead to information disclosure by leaking kernel memory contents into user space or hardware registers if the overread data influences subsequent operations. Furthermore, such flaws are often precursors to more severe exploitation vectors where an attacker might manipulate adjacent memory structures. The vulnerability aligns with CWE-125 (Out-of-bounds Read) and can be contextualized within ATT&CK techniques related to unauthorized access or system configuration modification via local privilege escalation paths if the affected registers control critical hardware behaviors.
The operational impact extends beyond simple memory safety violations due to endianness complications on specific architectures. On little-endian PowerPC systems, such as POWER8 and later models, the original code performed shifts that were only correct for big-endian kernels. Consequently, on little-endian platforms, a one-byte write would result in an out-of-bounds byte being written instead of the requested value. For two- and four-byte writes on big-endian systems, native 32-bit loads caused endianness reversal issues when passed to output functions like out_le16() or out_le32(), leading to incorrect data transmission over PCI I/O port space. These errors compromise system stability and hardware configuration integrity, potentially causing device malfunctions or unpredictable behavior in legacy PCI devices managed through these interfaces.
The resolution involves replacing the unconditional 32-bit load with architecture-aware helpers that respect the actual byte count provided by userspace. The fix utilizes get_unaligned_le16() for two-byte writes and get_unaligned_le32() for four-byte writes, ensuring that only the requested number of bytes are read from the buffer while correctly interpreting them as little-endian data to match PCI I/O port specifications. This approach eliminates both the out-of-bounds memory access and the endianness-related logic errors across different processor architectures. By strictly adhering to the user-specified length, the kernel ensures that no extra bytes are fetched from adjacent memory locations, thereby closing the information leak vector inherent in the previous implementation.
Mitigation strategies for this vulnerability primarily involve applying the upstream Linux kernel patch that corrects the pci_write_legacy_io function. System administrators managing systems with Alpha or PowerPC architectures should ensure their kernels are updated to versions containing this fix. Since the affected sysfs file requires root access, the immediate risk of remote exploitation is negligible; however, local privilege escalation risks persist if an attacker gains initial root access and seeks to exploit kernel memory corruption for further persistence or evasion. Regular patching cycles and monitoring KASAN logs in development environments are recommended practices to detect similar out-of-bounds issues early in the software lifecycle before they reach production systems.