CVE-2026-89751: x86/tdx: Fix off-by-one in port I/O handling
In the Linux kernel, the following vulnerability has been resolved:
x86/tdx: Fix off-by-one in port I/O handling
handlein() and handleout() in arch/x86/coco/tdx/tdx.c use:
u64 mask = GENMASK(BITSPERBYTE size, 0);
GENMASK(h, l) includes bit h. For size=1 (INB), this produces GENMASK(8, 0) = 0x1FF (9 bits) instead of GENMASK(7, 0) = 0xFF (8 bits). The mask is one bit too wide for all I/O sizes.
Fix the mask calculation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the off-by-one in port I/O handling by changing the mask calculation in handle_in() and handle_out() (arch/x86/coco/tdx/tdx.c) from `u64 mask = GENMASK(BITS_PER_BYTE * size, 0);` to `u64 mask = GENMASK(BITS_PER_BYTE * size - 1, 0);` so the mask is one bit too wide is corrected for all I/O sizes (e.g., size=1 should be GENMASK(7, 0)=0xFF, not GENMASK(8, 0)=0x1FF).
Linux kernel (arch/x86/coco/tdx/tdx.c) mask calculation in handle_in()/handle_out() = u64 mask = GENMASK(BITS_PER_BYTE * size - 1, 0);
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected code is in the Linux kernel's x86 TDX port I/O handling path, specifically handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c. Systems not using this code path are not identified as affected by the provided information.
What is the practical effect of the flaw?
The port I/O mask is one bit wider than the requested I/O size. For example, one-byte INB operations use a 9-bit mask (0x1FF) rather than the expected 8-bit mask (0xFF); the same off-by-one condition applies to all I/O sizes.
How can I determine whether the issue has been fixed?
Check whether the kernel includes the correction to the mask calculation in arch/x86/coco/tdx/tdx.c so that the upper bit is BITS_PER_BYTE * size - 1 rather than BITS_PER_BYTE * size. The provided stable-kernel references identify commits containing the fix.