CVE-2026-93206 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
PCI/proc: Use file_ns_capable() when checking config space read access
proc_bus_pci_read() decides how much of the config space is readable based on capable(CAP_SYS_ADMIN), which checks the credentials of the task calling read(), not the credentials of the process that opened the file.
The sysfs equivalent, pci_read_config(), has checked the credentials of the opening process since commit de139a339395 ("pci: check caps from sysfs file open to read device dependent config space"), so a privileged process can open the config space file and pass the file descriptor to an unprivileged process (for example, a process running a KVM guest with an assigned device), which can then read the entire config space. The check was subsequently routed through the LSM framework in commit 47970b1b2aa6 ("pci: use security_capable() when checking capablities during config space read") and converted to the dedicated helper in commit ab0fa82b2df9 ("pci-sysfs: use proper file capability helper function").
Thus, the two interfaces check the same capability against different credentials. Checking the credentials of the task calling read() makes the outcome depend on who reads rather than who opened, so the restriction is bypassed whenever a more privileged process reads through the descriptor. Checking the credentials recorded in file->f_cred settles the decision at open() time and ties it to the file, where it cannot change with the caller.
Use file_ns_capable() to check CAP_SYS_ADMIN against the credentials in effect when the file was opened, bringing the procfs interface in line with the sysfs behaviour.
As a result, a file descriptor opened by a privileged process and passed to an unprivileged one now allows the entire config space to be read through procfs, matching sysfs.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel's PCI subsystem contains a discrepancy between how access control is enforced for reading device configuration spaces via two different virtual filesystem interfaces: procfs and sysfs. This inconsistency stems from the specific credential checks performed during file operations. Specifically, the function proc_bus_pci_read() determines read permissions based on whether the current task holds CAP_SYS_ADMIN privileges at the moment of the read operation. In contrast, the equivalent sysfs interface pci_read_config() validates credentials against the process that originally opened the file descriptor. This divergence creates a security gap where access control decisions are tied to the caller rather than the context in which the resource was acquired.
The operational impact of this flaw is significant for environments utilizing device assignment features such as KVM with PCI passthrough. A privileged process, possessing CAP_SYS_ADMIN, can open a configuration space file descriptor and subsequently pass it to an unprivileged process. Because procfs checks credentials at read time rather than open time, the unprivileged caller inherits the access rights implicitly through the shared file descriptor without needing its own privileges. This allows lower-privilege processes to bypass intended restrictions and read sensitive hardware configuration data that should remain inaccessible. Such unauthorized access can expose critical system information or facilitate further exploitation of PCI devices assigned to virtual machines.
This vulnerability aligns with CWE-250, which describes operations performed with insufficiently privileged credentials, as well as CWE-732, concerning incorrect permission assignment for essential security-critical resources. From an ATT&CK perspective, this flaw facilitates privilege escalation and unauthorized access to system information, allowing attackers to gather intelligence on hardware configurations that could aid in subsequent attacks against virtualized environments or physical devices. The issue highlights the importance of consistent credential validation across different kernel interfaces handling sensitive resources.
To mitigate this vulnerability, the Linux kernel has been updated to utilize file_ns_capable() for checking CAP_SYS_ADMIN during config space read operations within procfs. This change ensures that capability checks are performed against the credentials recorded when the file was opened, rather than those of the current task executing the read command. By aligning procfs behavior with sysfs, the kernel enforces access control at the point of resource acquisition, preventing unprivileged processes from leveraging elevated privileges held by other tasks through shared file descriptors. System administrators should ensure their kernels are updated to include this patch and verify that device assignment policies strictly limit which users or groups can open PCI configuration files in privileged contexts.