CVE-2026-89722: PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()
In the Linux kernel, the following vulnerability has been resolved:
PCI/sysfs: Fix out-of-bounds read in pciwritelegacyio()
pciwritelegacyio() loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote:
if (count != 1 && count != 2 && count != 4) return -EINVAL;
return pcilegacywrite(bus, off, (u32 )buf, count);
kernfsfopwriteiter() allocates the buffer with kmalloc(len + 1), so a 1-byte write to the legacyio sysfs file allocates 2 bytes and the unconditional u32 load reads up to 2 bytes past the end of the allocation, which KASAN reports as a slab-out-of-bounds read. Similarly, a 2-byte write overreads by 1 byte.
Thus, read only the number of bytes requested using getunalignedle16() and getunalignedle32() for the 2 and 4 byte cases, interpreting the buffer as little-endian to match the byte ordering of PCI I/O port space.
The PowerPC implementation previously compensated for the generic code's native-endian 32-bit load by shifting the value into place for the 1 and 2 byte cases. The shifts were only correct on big-endian kernels.
On little-endian PowerPC (POWER8 and later), they extracted the wrong bytes, so a 1-byte write wrote an out-of-bounds byte instead of the requested value. On big-endian, the native load also caused outle16() and outle32() to reverse the user's bytes on the wire for 2 and 4 byte writes. The little-endian helpers resolve both issues, so the shifts are removed.
No changes are needed for the Alpha platform.
The legacyio file is root-only and exists only on Alpha and PowerPC, the two architectures that define HAVEPCILEGACY.
Affected Software
Event History
Frequently Asked Questions
What access would an attacker need to trigger the out-of-bounds read?
They would need to be able to write to the PCI bus legacy_io sysfs file. The overread is triggered by a 1-byte or 2-byte write; 4-byte writes do not have this specific short-buffer condition.
How can I tell whether the issue is occurring on a system under test?
KASAN can report the condition as a slab-out-of-bounds read when pci_write_legacy_io() handles a short write to legacy_io. A 1-byte write reads up to 2 bytes beyond the allocation, while a 2-byte write reads 1 byte beyond it.
Is there a separate functional impact on PowerPC systems?
Yes. On little-endian PowerPC systems, including POWER8 and later, the prior handling of 1-byte and 2-byte writes could select the wrong bytes and write an unintended value to PCI I/O port space.