CVE-2026-89722

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()

pci_write_legacy_io() loads 4 bytes from the kernfs write buffer

regardless of how many bytes userspace wrote:

if (count != 1 && count != 2 && count != 4)

return -EINVAL;

return pci_legacy_write(bus, off, *(u32 *)buf, count);

kernfs_fop_write_iter() allocates the buffer with kmalloc(len + 1),

so a 1-byte write to the legacy_io sysfs file allocates 2 bytes and

the unconditional u32 load reads up to 2 bytes past the end of the

allocation, which KASAN reports as a slab-out-of-bounds read.

Similarly, a 2-byte write overreads by 1 byte.

Thus, read only the number of bytes requested using get_unaligned_le16()

and get_unaligned_le32() for the 2 and 4 byte cases, interpreting the

buffer as little-endian to match the byte ordering of PCI I/O port

space.

The PowerPC implementation previously compensated for the generic

code's native-endian 32-bit loa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References