CVE-2026-90891 Overview
CVE-2026-90891 is an Improper Access Control vulnerability [CWE-1256] in the ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. The associated kernel-mode driver exposes an I/O Control (IOCTL) interface that fails to properly restrict access to sensitive I/O ports. Authenticated local attackers can send a specially crafted IOCTL request that causes the driver to write to improperly restricted I/O ports. The result is a forced operating system reboot, disrupting availability on the affected host.
Critical Impact
A local, authenticated attacker can trigger an unscheduled operating system reboot by abusing the Polychrome driver IOCTL interface, causing loss of availability and potential data loss for in-progress workloads.
Affected Products
- ASRock Polychrome SYNC utility
- ASRock Polychrome RGB utility
- Systems running the associated ASRock Polychrome kernel-mode driver
Discovery Timeline
- 2026-09-14 - CVE-2026-90891 published to the National Vulnerability Database (NVD)
- 2026-09-18 - Record last modified in the NVD database
Technical Details for CVE-2026-90891
Vulnerability Analysis
The Polychrome SYNC/RGB utility installs a signed kernel-mode driver used to control motherboard and peripheral RGB lighting. The driver exposes IOCTL handlers that forward operations to low-level hardware interfaces, including x86 I/O ports. The handlers do not adequately validate which port addresses a caller may target. A local user with the ability to open a handle to the driver can therefore submit an IOCTL that instructs the driver to write attacker-chosen values to sensitive I/O ports. Writing to specific platform control ports can trigger an immediate hardware-initiated reset, forcing the operating system to reboot without an orderly shutdown. Additional technical context is available in the TW-CERT Security Advisory.
Root Cause
The root cause is missing hardware-resource access restriction inside the driver's IOCTL dispatch logic, matching the pattern described by [CWE-1256] (Improper Restriction of Software Interfaces to Hardware Features). The driver treats any authorized caller as trusted to select arbitrary I/O port targets, rather than confining writes to a fixed allow-list of ports required for lighting control.
Attack Vector
Exploitation requires local access and low-privileged authenticated credentials on the target host. No user interaction is required. An attacker opens a handle to the exposed device object created by the Polychrome driver, then issues a crafted DeviceIoControl request specifying the vulnerable IOCTL and an I/O port write payload. The driver executes the write in kernel context, and the platform responds by resetting. Because no code execution or privilege escalation is achieved, the impact is limited to availability loss.
Detection Methods for CVE-2026-90891
Indicators of Compromise
- Presence of the ASRock Polychrome driver device object on hosts that do not require RGB management, particularly on servers or production endpoints.
- Unexpected system reboots on hosts with the Polychrome driver loaded, without corresponding scheduled tasks, patch cycles, or hardware faults in firmware logs.
- Process creation events showing non-administrative user sessions opening handles to the Polychrome driver device path.
Detection Strategies
- Inventory endpoints for installed ASRock Polychrome SYNC/RGB software and the associated driver binary to identify exposed hosts.
- Correlate Windows Event Log entries Kernel-Power event ID 41 with recent low-privileged process activity that references the driver device object.
- Alert on DeviceIoControl calls from non-administrative processes targeting the Polychrome driver, which is atypical for standard user workflows.
Monitoring Recommendations
- Monitor for driver load events for the Polychrome kernel driver on systems where lighting control is not an operational requirement.
- Track abrupt reboot patterns across managed endpoints and pivot to preceding process telemetry for the affected host.
- Review vendor advisories from ASRock and the TW-CERT Alert Notice for updated fixed-version information.
How to Mitigate CVE-2026-90891
Immediate Actions Required
- Identify all endpoints where the ASRock Polychrome SYNC/RGB utility and its kernel driver are installed.
- Uninstall the Polychrome utility on systems that do not require RGB lighting control, especially servers, workstations handling sensitive workloads, and shared multi-user hosts.
- Restrict interactive and remote local logon rights on affected systems to reduce the population of accounts capable of issuing the vulnerable IOCTL.
Patch Information
At the time of publication, no fixed version is enumerated in the NVD record. Review the TW-CERT Security Advisory and ASRock's official support channels for updated driver and utility releases addressing CVE-2026-90891, and apply the vendor-supplied update once available.
Workarounds
- Remove the Polychrome driver from hosts that do not need lighting control, eliminating the vulnerable IOCTL surface entirely.
- Apply Windows Defender Application Control or similar driver block-list policies to prevent loading of the vulnerable driver version until a patched build is deployed.
- Enforce least-privilege on endpoints so untrusted local users cannot execute arbitrary binaries capable of opening the driver device object.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.