Executive brief
The Linux kernel on Alpha-based systems did not properly enforce security lockdown controls when userspace applications attempted to directly access PCI device memory regions (BARs). This could allow an attacker to bypass kernel security mechanisms and perform DMA attacks that expose or corrupt memory, especially when the kernel is in a secured/locked-down state.
Technical details
The vulnerability is a missing security check in the Alpha architecture's pci_mmap_resource() function. The function allows userspace to memory-map PCI BAR (Base Address Register) regions but was not calling security_locked_down(LOCKDOWN_PCI_ACCESS) before permitting access. The generic PCI code had implemented this check since commit eb627e17727e to prevent DMA-based attacks when the kernel operates in locked-down mode. The fix adds the same security check to Alpha's architecture-specific implementation. No user interaction is required; an unprivileged local user with /sys/bus/pci access can trigger this. The patch has been merged into stable kernel releases across multiple versions.
Affected products
- Linux Linux kernel Alpha architecture prior to commit 78a228f0aa0e9eba
Timeline
- 2026-05-08: other: Patch authored
- 2026-07-24: patched: Fix merged into stable kernel trees
- 2026-09-04: disclosed: CVE-2026-80867 published