CVE-2026-89795: Linux Kernel PCI Slot Privilege Escalation

CVE-2026-89795 is a privilege escalation vulnerability in Linux Kernel affecting PCI slot reset functionality on s390 systems. The flaw causes incorrect function resets and memory leaks in multifunction devices. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-89795 Overview

CVE-2026-89795 is a Linux kernel vulnerability affecting PCI slot handling on IBM s390 systems. The flaw resides in the PCI subsystem, where pci_create_slot() assigns the same pci_slot object to multifunction devices sharing a PCI domain. On s390, the hotplug driver's reset_slot() wrapper for zpci_hot_reset_device() operates at per-function granularity. When multifunction PCI topology is exposed through a shared domain, the shared slot assignment causes the wrong function to be reset. The bug also leaks memory because per-function pci_slot objects are created but not correctly freed in pci_slot_release().

Critical Impact
A local authenticated user can trigger incorrect PCI function resets and kernel memory leaks, resulting in integrity and availability loss on affected s390 hosts.

Affected Products

Linux kernel PCI subsystem on IBM s390 architecture
s390 PCI hotplug driver (zpci_hot_reset_device)
Systems using multifunction PCI topology introduced by commit 44510d6fa0c0 ("s390/pci: Handling multifunctions")

Discovery Timeline

2026-09-16 - CVE-2026-89795 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89795

Vulnerability Analysis

The vulnerability is a kernel-level logic and resource management flaw in the Linux PCI slot layer. On s390 systems, the machine-level hypervisor grants PCI access through pass-through that operates at per-PCI-function granularity. The s390 hotplug driver creates hotplug slots for individual functions, and its reset_slot() implementation calls zpci_hot_reset_device() to reset a single function.

Before commit 44510d6fa0c0, s390 exposed only virtual functions as independent PCI domains, so the generic behavior of pci_create_slot() assigning the same pci_slot object to all functions of a multifunction device was harmless. After multifunction topology support was added, functions on s390 can share a PCI domain. The shared pci_slot assignment now causes reset_slot() to act on an unintended function. Additionally, pci_slot_release() fails to free per-function slot objects, producing a kernel memory leak.

Root Cause

The root cause is an incorrect assumption in the generic PCI slot allocation logic. pci_create_slot() treats multifunction devices as sharing a single slot, which conflicts with hypervisor-managed environments where each function is independently resettable. The fix introduces a flag on struct pci_slot to allow per-function slots and changes the slot number field from u8 to u16 to accommodate the new sentinel values PCI_SLOT_PLACEHOLDER and PCI_SLOT_ALL_DEVICES.

Attack Vector

Exploitation requires local access with low privileges on an s390 host running an affected kernel. An actor with permission to invoke PCI hotplug slot reset operations can cause the wrong PCI function to be reset, disrupting workloads bound to that function. Repeated invocations amplify the kernel memory leak in pci_slot_release(), degrading system availability over time. See the upstream fixes: Kernel Commit 2050d90, Kernel Commit dcc5bec, and Kernel Commit ecdcceed.

Detection Methods for CVE-2026-89795

Indicators of Compromise

Unexpected PCI function resets on s390 hosts recorded in dmesg or the systemd journal, particularly messages from zpci and the PCI hotplug subsystem
Progressive growth of kernel slab memory attributable to pci_slot allocations without corresponding frees
Guest workloads reporting device stalls or driver reinitialization for PCI functions that were not the target of an administrative reset

Detection Strategies

Inventory s390 systems and compare running kernel versions against the fixed commits referenced by upstream stable trees
Audit invocations of the sysfs hotplug reset_slot interface under /sys/bus/pci/slots/*/ and correlate with the affected function identifiers
Monitor kernel memory accounting for anomalous growth tied to PCI hotplug operations on multifunction devices

Monitoring Recommendations

Forward kernel logs from s390 hosts to a centralized log store and alert on repeated zpci_hot_reset_device events
Track PCI hotplug slot creation and release counts to identify imbalance indicating the memory leak
Baseline authorized administrators permitted to perform PCI slot resets and alert on operations outside that baseline

How to Mitigate CVE-2026-89795

Immediate Actions Required

Apply the upstream kernel fixes referenced by commits 2050d900, dcc5bec0, and ecdcceed4 or install the vendor kernel update containing them
Restrict access to PCI hotplug slot reset interfaces to trusted administrators only
Reboot affected s390 hosts after patching to clear any leaked pci_slot allocations

Patch Information

The Linux kernel maintainers resolved the issue by adding a per-function slot flag to struct pci_slot, widening the slot number field to u16, and introducing the PCI_SLOT_PLACEHOLDER and PCI_SLOT_ALL_DEVICES sentinel values. The corrected slot release path frees per-function objects. Fixes are available in the referenced stable kernel commits: 2050d900, dcc5bec0, and ecdcceed4.

Workarounds

Avoid using the hotplug slot reset path on multifunction PCI devices on s390 hosts until patched
Limit local shell and administrative access on s390 systems to reduce the pool of users who can invoke PCI reset operations
Where feasible, retain the pre-multifunction PCI configuration that exposes only virtual functions as independent PCI domains