CVE-2026-89751: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89751 Overview

CVE-2026-89751 is an off-by-one flaw in the Linux kernel's Intel Trust Domain Extensions (TDX) port I/O handling code. The defect resides in handle_in() and handle_out() within arch/x86/coco/tdx/tdx.c. Both functions compute a bitmask using GENMASK(BITS_PER_BYTE * size, 0), which produces a mask one bit wider than the requested I/O width. For a single-byte INB, the code generates GENMASK(8, 0) = 0x1FF rather than the intended GENMASK(7, 0) = 0xFF. The issue affects the TDX guest path that emulates legacy port I/O through the hypervisor.

Critical Impact
The oversized mask allows an extra bit from hypervisor-supplied I/O results to reach the guest, weakening the boundary between a TDX-protected guest and untrusted VMM-provided data.

Affected Products

Linux kernel builds enabling Intel TDX guest support (CONFIG_INTEL_TDX_GUEST)
x86_64 confidential computing guests using TDX for port I/O emulation
Multiple stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89751 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89751

Vulnerability Analysis

The defect is a classic off-by-one error [CWE-193] in bitmask construction. Intel TDX guests cannot directly execute port I/O instructions such as INB, INW, and INL. Instead, the kernel routes these through the TDX module using a TDVMCALL, and the untrusted VMM returns the requested value. handle_in() is expected to mask that returned value down to the correct byte width before returning it to the caller.

Because GENMASK(h, l) is inclusive on both ends, GENMASK(BITS_PER_BYTE * size, 0) yields size * 8 + 1 set bits rather than size * 8. A 1-byte read returns up to 9 bits of hypervisor-controlled data, a 2-byte read returns 17 bits, and a 4-byte read returns 33 bits. The extra high-order bit is attacker-influenced data crossing the guest trust boundary.

Root Cause

The root cause is misuse of the inclusive GENMASK macro. The correct upper bound for a mask covering size bytes is BITS_PER_BYTE * size - 1. The upstream fix adjusts the calculation so the mask exactly matches the requested I/O width.

Attack Vector

Exploitation requires a malicious or compromised hypervisor supplying crafted return values to a TDX guest's port I/O emulation path. A remote network attacker cannot trigger this directly. The concern is confidential computing threat model integrity: TDX explicitly treats the VMM as untrusted, and any extra bit accepted from the VMM undermines that guarantee. Downstream consumers of the returned value that assume a properly bounded byte, word, or dword may behave incorrectly when the high bit is set.

No verified public exploit code is available. See the upstream fixes for full technical detail: Kernel Git Commit 0f63e65, Kernel Git Commit 220011fe, and Kernel Git Commit c687542.

Detection Methods for CVE-2026-89751

Indicators of Compromise

No runtime IOCs are published for this issue; detection is primarily version-based against patched stable kernels.
Unexpected values above the documented port width returned to TDX guest drivers may indicate the unpatched code path is active.

Detection Strategies

Inventory all TDX-enabled guest images and confirm kernel build IDs against the fixed commits listed in the NVD references.
Audit kernel configuration for CONFIG_INTEL_TDX_GUEST=y to scope exposure to confidential computing workloads.
Use distribution security trackers to map the upstream fix hashes to vendor-shipped kernel package versions.

Monitoring Recommendations

Monitor guest kernel logs for anomalies in drivers that perform legacy port I/O within TDX guests.
Track vendor advisories for backports across Long Term Support kernel branches referenced in the six upstream commits.
Alert on deployment of TDX guest images built from kernels predating the fix commits.

How to Mitigate CVE-2026-89751

Immediate Actions Required

Update TDX guest kernels to a build that includes one of the upstream fix commits, such as 0f63e65, 220011fe, 222b700, bb45f70, c4a2215, or c687542.
Rebuild and redeploy TDX confidential computing guest images from patched sources.
Coordinate with cloud providers offering TDX-based confidential VMs to confirm host and guest kernel patch status.

Patch Information

The fix corrects the mask expression in handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c so that GENMASK produces exactly BITS_PER_BYTE * size bits. Patches are available across multiple stable kernel branches. Reference the upstream commits: 0f63e65, 220011fe, 222b700, bb45f70, c4a2215, and c687542.

Workarounds

No supported runtime workaround exists; the fix must be applied at the kernel source level.
Where TDX guest functionality is not required, disable CONFIG_INTEL_TDX_GUEST in custom kernel builds to remove the affected code path.
Restrict TDX guest deployments to trusted host platforms until patched guest kernels are rolled out.