Cloudanix VulnDB

CVE-2026-89722

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

On certain older computer systems running Linux, a programming mistake could let a highly privileged user read a little extra memory than intended, which might expose sensitive information or cause the computer to stop working.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in pci_write_legacy_io() caused by unconditionally loading 4 bytes from a kernfs buffer allocated only for the bytes written, overreading by up to 2 bytes on 1-byte writes and 1 byte on 2-byte writes to the legacy_io sysfs file.

Why it matters to the business

Affects only Linux kernels on Alpha and PowerPC platforms; root-only access limits exposure but successful exploitation can produce kernel memory disclosure or system instability on those architectures.

How an attack unfolds

An attacker with root privileges opens the legacy_io sysfs file on an affected Alpha or PowerPC system and performs a 1-byte or 2-byte write; the kernel reads beyond the end of the kmalloc allocation, allowing an out-of-bounds read that may leak kernel data or trigger a crash.

How to fix it

Upgrade to a kernel containing the corrected pci_write_legacy_io() implementation that uses get_unaligned_le16() and get_unaligned_le32() to read only the requested number of bytes and removes the PowerPC endianness compensation shifts.

How to confirm the fix worked

Confirm the running kernel source or binary includes the little-endian helper calls and lacks the unconditional u32 cast; test 1-byte, 2-byte, and 4-byte writes to legacy_io while monitoring for KASAN slab-out-of-bounds reports.

Typical attack path

  1. Obtain root privileges on an Alpha or PowerPC Linux system
  2. Locate the legacy_io sysfs file under the PCI device hierarchy
  3. Issue a 1-byte or 2-byte write to the legacy_io file
  4. Observe kernel memory disclosure or crash from the resulting slab-out-of-bounds read

How to detect it

Search kernel logs and KASAN reports for slab-out-of-bounds reads originating from pci_write_legacy_io or accesses involving the legacy_io sysfs file on Alpha and PowerPC systems.

What your security team should do

  • Apply the kernel fix on all Alpha and PowerPC systems before the CISA remediation deadline if applicable
  • Audit and restrict unnecessary root access to legacy PCI sysfs files
  • Enable KASAN or similar memory debugging on test systems to validate the absence of the read
  • Monitor kernel logs for any references to pci_write_legacy_io or legacy_io writes

The record

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() pci_write_legacy_io() loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if (count != 1 && count != 2 && count != 4) return -EINVAL; return pci_legacy_write(bus, off, *(u32 *)buf, count); kernfs_fop_write_iter() allocates the buffer with kmalloc(len + 1), so a 1-byte write to the legacy_io sysfs file allocates 2 bytes and the unconditional u32 load reads up to 2 bytes past the end of the allocation, which KASAN reports as a slab-out-of-bounds read. Similarly, a 2-byte write overreads by 1 byte. Thus, read only the number of bytes requested using get_unaligned_le16() and get_unaligned_le32() for the 2 and 4 byte cases, interpreting the buffer as little-endian to match the byte ordering of PCI I/O port space. The PowerPC implementation previously compensated for the generic code's native-endian 32-bit load by shifting the value into place for the 1 and 2 byte cases. The shifts were only correct on big-endian kernels. On little-endian PowerPC (POWER8 and later), they extracted the wrong bytes, so a 1-byte write wrote an out-of-bounds byte instead of the requested value. On big-endian, the native load also caused out_le16() and out_le32() to reverse the user's bytes on the wire for 2 and 4 byte writes. The little-endian helpers resolve both issues, so the shifts are removed. No changes are needed for the Alpha platform. The legacy_io file is root-only and exists only on Alpha and PowerPC, the two architectures that define HAVE_PCI_LEGACY.

Affected packages

Ecosystem Package Introduced Fixed