CVE-2026-89722: Linux Kernel PCI Sysfs Buffer Overflow

CVE-2026-89722 Overview

CVE-2026-89722 is an out-of-bounds read vulnerability in the Linux kernel's PCI sysfs interface. The flaw resides in pci_write_legacy_io(), which unconditionally loads 4 bytes from the kernfs write buffer regardless of the actual size the caller supplied. Because kernfs_fop_write_iter() allocates the buffer with kmalloc(len + 1), a 1-byte write allocates only 2 bytes, causing the u32 load to read up to 2 bytes past the end of the slab allocation. KASAN reports this as a slab-out-of-bounds read. The legacy_io sysfs file is root-only and exists only on Alpha and PowerPC architectures that define HAVE_PCI_LEGACY.

Critical Impact
Root-privileged writes to the PCI legacy_io sysfs file trigger slab-out-of-bounds reads. On little-endian PowerPC, incorrect byte extraction also caused out-of-bounds bytes to be written to PCI I/O ports.

Affected Products

Linux kernel builds with HAVE_PCI_LEGACY enabled
Alpha architecture systems exposing the PCI legacy_io sysfs interface
PowerPC architecture systems (including little-endian POWER8 and later)

Discovery Timeline

2026-09-11 - CVE-2026-89722 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89722

Vulnerability Analysis

The defect lives in the Linux kernel's PCI sysfs handler pci_write_legacy_io(). The function validates that the write count is 1, 2, or 4 bytes, then dereferences the buffer as a u32 pointer for every case. This unconditional 32-bit load ignores the actual number of bytes userspace supplied.

The kernfs write path allocates the buffer using kmalloc(len + 1). For a 1-byte write, only 2 bytes are allocated, so a 4-byte load reads 2 bytes beyond the allocation boundary. A 2-byte write overreads by 1 byte. KASAN flags both patterns as slab-out-of-bounds reads.

A secondary defect existed in the PowerPC implementation. Legacy shifts intended to compensate for native-endian 32-bit loads were only correct on big-endian kernels. On little-endian POWER8 and later systems, a 1-byte write emitted the wrong byte to the PCI I/O port. On big-endian kernels, out_le16() and out_le32() reversed the caller's bytes on the wire for 2 and 4 byte writes.

Root Cause

The root cause is improper input length handling combined with pointer type punning [Out-of-Bounds Read]. pci_write_legacy_io() reads a fixed 4-byte quantity via *(u32 *)buf when the sysfs buffer may legitimately be smaller than 4 bytes. The fix reads only the requested number of bytes using get_unaligned_le16() and get_unaligned_le32(), interpreting the buffer as little-endian to match PCI I/O port byte ordering.

Attack Vector

Exploitation requires local root privileges because the legacy_io sysfs node is restricted to root. A privileged process performing a 1 or 2 byte write to /sys/devices/pci*/legacy_io triggers the out-of-bounds read. The impact is limited to KASAN-detectable memory disclosure within adjacent slab objects and, on affected PowerPC configurations, incorrect data written to PCI I/O ports. No exploitation code is required beyond a small write to the sysfs file.

See the upstream commits for the corrected implementation: kernel commit 7a99e9c7, kernel commit dc76258d, and kernel commit e892f05f.

Detection Methods for CVE-2026-89722

Indicators of Compromise

KASAN reports referencing pci_write_legacy_io with a slab-out-of-bounds classification in kernel logs.
Unexpected values written to PCI I/O ports on little-endian PowerPC systems after root writes to legacy_io.
Root-user writes to /sys/devices/pci*/legacy_io with sizes of 1 or 2 bytes.

Detection Strategies

Enable KASAN in test and staging kernels to surface the out-of-bounds read at runtime.
Audit kernel version strings on Alpha and PowerPC hosts to confirm patched builds are deployed.
Review auditd rules to record any process opening or writing to legacy_io sysfs nodes.

Monitoring Recommendations

Ingest dmesg and /var/log/kern.log into a centralized logging pipeline and alert on KASAN and slab-out-of-bounds strings.
Track root shell activity and privileged file writes on Alpha and PowerPC systems.
Monitor for kernel oops or warnings originating from the PCI subsystem after routine maintenance windows.

How to Mitigate CVE-2026-89722

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE record and rebuild affected Alpha and PowerPC kernels.
Restrict local root access on impacted hosts to reduce the pool of accounts that can reach the vulnerable sysfs interface.
Verify that distribution-provided kernels include the fix before returning systems to production.

Patch Information

The vulnerability is fixed by replacing the unconditional u32 load with get_unaligned_le16() and get_unaligned_le32() for the 2 and 4 byte cases, reading only the requested number of bytes. The PowerPC compensation shifts were removed as part of the fix. Patch details are available in kernel commit 7a99e9c7, kernel commit dc76258d, and kernel commit e892f05f.

Workarounds

Remove or tighten permissions on /sys/devices/pci*/legacy_io where feasible so root tooling cannot inadvertently write 1 or 2 byte values.
Disable HAVE_PCI_LEGACY in custom kernel builds where legacy PCI I/O access is not required.
Limit interactive root sessions on Alpha and PowerPC hosts until the patched kernel is deployed.