CVE-2026-97505 Linux CVE debrief

Who should care

System administrators and Linux kernel developers should assess exposure and apply patches to prevent potential disruptions to active drivers and resource file updates. They should review and apply kernel patches, restrict access to the resourceN_resize sysfs attribute, and monitor system logs for potential BAR resize operations.

Why it matters

The Linux kernel vulnerability in the PCI/sysfs module allows unprivileged users to resize a BAR, which can disrupt active drivers and trigger resource file updates. System administrators and Linux kernel developers should assess exposure and apply patches to prevent potential disruptions.

• Disruption to active drivers due to unauthorized BAR resize operations
• Potential triggering of resource file updates via sysfs_update_groups()

Technical summary

The Linux kernel vulnerability in the PCI/sysfs module allows unprivileged users to resize a BAR, which can disrupt active drivers and trigger resource file updates. The vulnerability has been resolved by adding a CAP_SYS_ADMIN check to prevent unprivileged users from performing BAR resize operations. This fix prevents unauthorized modifications to BAR sizes, which can disrupt active drivers and trigger resource file updates via sysfs_update_groups(). System administrators and Linux kernel developers should assess exposure and apply patches to prevent potential disruptions.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the kernel patches to add CAP_SYS_ADMIN check for BAR resize operations
• Restrict access to the resourceN_resize sysfs attribute to authorized users
• Monitor system logs for potential BAR resize operations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, and kernel.org references provide source code changes. The vulnerability was introduced due to a lack of CAP_SYS_ADMIN check in the __resource_resize_store() function, allowing unprivileged users to resize BARs. The fix adds this check to prevent unauthorized BAR resize operations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.