CVE-2026-89751: x86/tdx: Fix off-by-one in port I/O handling
In the Linux kernel, the following vulnerability has been resolved:
x86/tdx: Fix off-by-one in port I/O handling
handlein() and handleout() in arch/x86/coco/tdx/tdx.c use:
u64 mask = GENMASK(BITSPERBYTE size, 0);
GENMASK(h, l) includes bit h. For size=1 (INB), this produces GENMASK(8, 0) = 0x1FF (9 bits) instead of GENMASK(7, 0) = 0xFF (8 bits). The mask is one bit too wide for all I/O sizes.
Fix the mask calculation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In arch/x86/coco/tdx/tdx.c, fix the mask calculation used by handle_in() and handle_out() by changing GENMASK(BITS_PER_BYTE * size, 0) to GENMASK(BITS_PER_BYTE * size - 1, 0), so size=1 produces GENMASK(7, 0) = 0xFF rather than GENMASK(8, 0) = 0x1FF.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected code is in the Linux kernel's x86 TDX port I/O handling path, specifically handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c. Systems not using this code path are not identified as affected by the provided information.
What is the practical effect of the flaw?
The port I/O mask is one bit wider than the requested I/O size. For example, one-byte INB operations use a 9-bit mask (0x1FF) rather than the expected 8-bit mask (0xFF); the same off-by-one condition applies to all I/O sizes.
How can I determine whether the issue has been fixed?
Check whether the kernel includes the correction to the mask calculation in arch/x86/coco/tdx/tdx.c so that the upper bit is BITS_PER_BYTE * size - 1 rather than BITS_PER_BYTE * size. The provided stable-kernel references identify commits containing the fix.