UBUNTU-CVE-2026-97505: Low severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Add CAPSYSADMIN check to resourceresizestore() Currently, the resourceresizestore() allows writing to the resourceNresize sysfs attribute to change a BAR's size without checking for capabilities, currently relying only on the file access check. Resizing a BAR modifies PCI device configuration and can disrupt active drivers. After the upcoming conversion to static attributes, it will also trigger resource file updates via sysfsupdategroups(). Add a CAPSYSADMIN check to prevent unprivileged users from performing BAR resize operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Add a CAP_SYS_ADMIN capability check before allowing writes to the resourceN_resize sysfs attribute and BAR resize operations.
Linux kernel PCI sysfs __resource_resize_store() = require CAP_SYS_ADMIN
Event History
Frequently Asked Questions
Who can exploit this issue?
A local unprivileged user who can write to a PCI device's resourceN_resize sysfs attribute can resize a BAR. The vulnerable code relied on file access permissions rather than requiring CAP_SYS_ADMIN.
What is the practical impact of a successful BAR resize?
Resizing a BAR changes PCI device configuration and can disrupt active device drivers. It may also trigger resource-file updates through sysfs when static attributes are introduced.
What access is required after the fix?
The operation requires the CAP_SYS_ADMIN capability. Users without that capability should no longer be able to resize BARs through the resourceN_resize sysfs attribute.
Which Ubuntu kernel packages are listed as affected?
The advisory lists ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-gcp, and ubuntu/linux-gcp-fips.