CVE-2026-80867: Linux Kernel Alpha PCI Privilege Escalation Flaw

CVE-2026-80867 Overview

CVE-2026-80867 affects the Linux kernel on the Alpha architecture. The pci_mmap_resource() function does not call security_locked_down(LOCKDOWN_PCI_ACCESS) before allowing userspace to memory-map PCI Base Address Registers (BARs). The generic PCI implementation has enforced this check since commit eb627e17727e ("PCI: Lock down BAR access when the kernel is locked down") to prevent Direct Memory Access (DMA) attacks against a locked-down kernel. The Alpha-specific path missed this hardening. A local user with sufficient privileges can bypass kernel lockdown protections and map PCI device memory directly.

Critical Impact
Missing lockdown enforcement on Alpha's pci_mmap_resource() allows userspace mmap of PCI BARs, defeating LOCKDOWN_PCI_ACCESS and enabling DMA-based tampering with a locked-down kernel.

Affected Products

Linux kernel — Alpha architecture PCI subsystem
Kernels containing arch/alpha/kernel/pci.cpci_mmap_resource() without the lockdown check
Distributions shipping Alpha kernel builds prior to the referenced stable commits

Discovery Timeline

2026-09-04 - CVE-2026-80867 published to the National Vulnerability Database (NVD)
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80867

Vulnerability Analysis

The Linux kernel lockdown Linux Security Module (LSM) restricts operations that would let userspace subvert kernel integrity. LOCKDOWN_PCI_ACCESS specifically blocks paths that expose PCI device memory to userspace, because a peripheral capable of DMA can be programmed from userspace to read or write arbitrary physical memory. The generic PCI mmap implementation consults security_locked_down(LOCKDOWN_PCI_ACCESS) and denies the request when lockdown is active.

Alpha maintains its own pci_mmap_resource() implementation and never received the equivalent gate. On an Alpha system running a locked-down kernel, a privileged process can still mmap a PCI BAR through sysfs resource files, obtain a mapping to device configuration or MMIO space, and program the device to perform DMA. This bypasses a control the administrator relied on to preserve kernel integrity.

Root Cause

The root cause is a missing security check in an architecture-specific code path. When the generic hardening landed in commit eb627e17727e, the Alpha variant of pci_mmap_resource() was not updated in parallel. The fix adds the security_locked_down(LOCKDOWN_PCI_ACCESS) call to Alpha's implementation so behavior matches the generic path. This is an access control gap rather than a memory-safety defect.

Attack Vector

Exploitation requires local access on an Alpha system with a lockdown-enabled kernel and privileges sufficient to open PCI sysfs resource files (typically CAP_SYS_RAWIO or root). An attacker with such access can mmap a PCI BAR that lockdown was intended to forbid, then drive the device to perform DMA reads or writes against kernel memory. This can be leveraged to disable lockdown, patch kernel code, or exfiltrate secrets. No remote or unauthenticated attack vector is described in the advisory.

No public proof-of-concept code is referenced in the enriched data. See the kernel commits for the exact source-level change.

Detection Methods for CVE-2026-80867

Indicators of Compromise

Unexpected processes opening /sys/bus/pci/devices/*/resource* files with PROT_WRITE or PROT_READ mmap requests on Alpha hosts.
Kernel log entries showing successful PCI BAR mappings on systems where lockdown is expected to block them.
Loading of userspace tools that manipulate PCI devices directly (for example, custom DMA programmers) on locked-down systems.

Detection Strategies

Audit kernel version and architecture on Alpha hosts; flag builds that predate the fix commits 257b55d, 4de5ff9, 6e36848, 78a228f, 85f966b, 94defb1, c3234ef, and ed2cd1f.
Enable Linux audit rules on /sys/bus/pci/devices/*/resource* open and mmap events and alert on non-baseline callers.
Correlate use of CAP_SYS_RAWIO with PCI sysfs access, which is uncommon in normal workloads.

Monitoring Recommendations

Forward auditd and kernel logs from Alpha systems to a central analytics platform for retention and correlation.
Track lockdown state via /sys/kernel/security/lockdown and alert if the mode changes unexpectedly.
Baseline expected consumers of PCI resource files per host and alert on new binaries accessing them.

How to Mitigate CVE-2026-80867

Immediate Actions Required

Update Alpha kernels to a stable release that includes the security_locked_down(LOCKDOWN_PCI_ACCESS) check in pci_mmap_resource().
Ensure kernel lockdown is enabled in integrity or confidentiality mode where the security model requires it.
Restrict CAP_SYS_RAWIO and root access to trusted service accounts only.

Patch Information

The fix adds the missing security_locked_down(LOCKDOWN_PCI_ACCESS) call to Alpha's pci_mmap_resource(), aligning behavior with the generic implementation introduced by commit eb627e17727e. Backports are available across multiple stable branches. Reference the upstream commits: 257b55d, 4de5ff9, 6e36848, 78a228f, 85f966b, 94defb1, c3234ef, and ed2cd1f.

Workarounds

Remove or restrict permissions on /sys/bus/pci/devices/*/resource* files so only trusted administrators can open them.
Avoid granting CAP_SYS_RAWIO to unprivileged services or containers on Alpha hosts.
Where feasible, decommission Alpha hardware in favor of architectures that receive faster security parity with the generic PCI path.

bash

# Verify lockdown state and PCI sysfs exposure on Alpha hosts
cat /sys/kernel/security/lockdown
uname -m
ls -l /sys/bus/pci/devices/*/resource*
# Optional: audit rule for PCI resource access
auditctl -w /sys/bus/pci/devices/ -p rwa -k pci_resource_access