Cloudanix VulnDB

CVE-2026-89751

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small calculation mistake in the Linux kernel's handling of special secure virtual machines could cause input and output operations to read or write one bit too many, which might corrupt data or crash those protected systems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Off-by-one error in GENMASK calculation for port I/O masks in TDX handle_in/handle_out causes one extra bit to be set in the mask for every I/O size, allowing the mask to cover an unintended extra bit position.

Why it matters to the business

In TDX-protected VMs this can produce incorrect port I/O results, leading to data corruption, guest crashes, or unexpected behavior inside confidential compute workloads; low exploitability keeps immediate risk modest but still requires prompt kernel updates.

How an attack unfolds

An attacker with the ability to issue port I/O instructions from within a TDX guest would trigger the widened mask during IN/OUT emulation; the extra bit could cause the hypervisor to read or write one bit beyond the intended I/O value, potentially leaking or corrupting adjacent state.

How to fix it

Update to a Linux kernel containing the corrected mask calculation (GENMASK(BITS_PER_BYTE*size-1,0) or equivalent). Rebuild and redeploy any TDX-enabled kernels; test I/O paths in confidential VMs after upgrade.

How to confirm the fix worked

Inspect arch/x86/coco/tdx/tdx.c for the corrected GENMASK expression; run kernel selftests covering TDX port I/O; verify no regression in guest I/O behavior under TDX.

Typical attack path

  1. Obtain code execution inside a TDX guest
  2. Issue crafted INB/INW/IND or OUTB/OUTW/OUTD instructions targeting emulated ports
  3. Trigger the incorrect GENMASK result during handle_in or handle_out
  4. Observe or manipulate the extra bit of I/O data for further exploitation

How to detect it

Review TDX hypervisor logs for unexpected port I/O sizes or mask-related anomalies; examine guest kernel crashes or I/O errors occurring shortly after TDX entry; no widespread exploitation artifacts are currently known.

What your security team should do

  • Apply the upstream TDX port-I/O fix to all kernels supporting TDX within the next patch cycle
  • Confirm TDX workloads are running on fixed kernels before re-enabling production confidential VMs
  • Monitor EPSS and exploit maturity; increase priority if public PoCs appear

The record

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASK(BITS_PER_BYTE * size, 0); GENMASK(h, l) includes bit h. For size=1 (INB), this produces GENMASK(8, 0) = 0x1FF (9 bits) instead of GENMASK(7, 0) = 0xFF (8 bits). The mask is one bit too wide for all I/O sizes. Fix the mask calculation.

Affected packages

Ecosystem Package Introduced Fixed