CVE-2026-90315: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers
In the Linux kernel, the following vulnerability has been resolved:
PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers
Currently, the legacy I/O and memory sysfs handlers do not check securitylockeddown(LOCKDOWNPCIACCESS), leaving the legacyio and legacymem files unprotected when the kernel is locked down.
Commit eb627e17727e ("PCI: Lock down BAR access when the kernel is locked down") added the check to pciwriteconfig(), pcimmapresource(), and pciwriteresourceio() to prevent userspace from programming DMA-capable hardware that could be used to modify kernel code, but did not cover the legacy handlers.
As a result, root can still write arbitrary I/O ports and map the legacy I/O and memory spaces while the kernel is locked down, which is the same capability the lockdown is meant to remove.
Add the same check to pciwritelegacyio(), pcimmaplegacymem(), and pcimmaplegacyio().
These generic handlers cover both architectures that define HAVEPCILEGACY (such as Alpha and PowerPC).
[bhelgaas: add Link]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch eb627e17727e
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs root-level access on a locked-down Linux kernel and access to the PCI legacy sysfs handlers. The issue allows root to write arbitrary I/O ports and map legacy I/O or memory spaces despite lockdown.
Is a locked-down kernel configuration affected?
Yes. The vulnerable legacy_io and legacy_mem sysfs handlers did not enforce security_locked_down(LOCKDOWN_PCI_ACCESS), even though related PCI configuration, resource mapping, and resource I/O write paths already had lockdown checks.
What is the impact of successful exploitation?
The attacker can regain the ability to program DMA-capable hardware through legacy PCI access paths, potentially enabling modification of kernel code. This bypasses the restriction that kernel lockdown is intended to impose.
What changes in the fix?
The fix adds the PCI-access lockdown check to pci_write_legacy_io(), pci_mmap_legacy_mem(), and pci_mmap_legacy_io(). These generic handlers also cover architectures using HAVE_PCI_LEGACY, including Alpha and PowerPC.