CVE-2026-89722 Linux CVE debrief

Who should care

Linux system administrators, security teams, and developers using the Linux kernel's PCI/sysfs functionality should be aware of this vulnerability. They should assess their exposure based on their specific Linux distributions and versions, focusing on those using the affected PCI/sysfs functionality.

Why it matters

This vulnerability in the Linux kernel's PCI/sysfs subsystem can lead to out-of-bounds reads, potentially causing system crashes or data exposure. Linux system administrators and security teams should prioritize verifying the Linux kernel version and applying patches to mitigate this vulnerability.

• Verify Linux kernel versions to determine exposure
• Apply patches to mitigate the vulnerability
• Review system configurations for affected PCI/sysfs functionality
• Assess potential data exposure or system crashes due to out-of-bounds reads

Technical summary

The Linux kernel's PCI/sysfs subsystem is vulnerable to an out-of-bounds read. When writing to the legacy_io sysfs file, the code loads 4 bytes from the write buffer regardless of the number of bytes written by userspace. This causes a slab-out-of-bounds read according to KASAN. The issue arises from the unconditional u32 load in pci_write_legacy_io(), which reads up to 2 bytes past the end of the allocation for 1-byte and 2-byte writes.

Defensive priority

Linux system administrators and security teams should prioritize verifying the Linux kernel version and applying patches to mitigate this vulnerability. They should assess exposure based on their specific Linux distributions and versions, focusing on those using the affected PCI/sysfs functionality.

Recommended defensive actions

• Verify Linux kernel versions and apply patches to mitigate the vulnerability
• Assess exposure based on specific Linux distributions and versions
• Review system configurations for affected PCI/sysfs functionality
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability was resolved by changing pci_write_legacy_io() to only read the number of bytes requested using get_unaligned_le16() and get_unaligned_le32() for 2 and 4 byte cases. The PowerPC implementation's previous compensation for native-endian 32-bit loads was also addressed, ensuring correct byte extraction on both big-endian and little-endian kernels.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.