Executive brief
A bug in the Linux kernel's PCI subsystem allows unauthorized memory reads when writing to the legacy I/O sysfs interface. While restricted to root-only access, the vulnerability exposes kernel memory that could leak sensitive data, particularly on PowerPC systems where byte ordering issues compound the problem.
Technical details
The pci_write_legacy_io() function unconditionally loads 4 bytes from the kernfs write buffer using a u32 cast, regardless of whether the user wrote 1, 2, or 4 bytes. Since kernfs allocates the buffer with kmalloc(len + 1), writes of 1 or 2 bytes result in KASAN-reported slab-out-of-bounds reads. Additionally, the PowerPC implementation compounds the issue through incorrect byte-order handling: on little-endian PowerPC (POWER8+), the bit shifts extract wrong bytes, and on big-endian systems, native-endian loads cause incorrect byte reversal. The fix replaces the unconditional u32 load with get_unaligned_le16() and get_unaligned_le32(), reading only the requested bytes and interpreting them as little-endian to match PCI I/O port byte ordering. The legacy_io interface is root-only and exists only on Alpha and PowerPC architectures.
Affected products
- Linux Linux kernel multiple versions with HAVE_PCI_LEGACY support (Alpha and PowerPC)
Timeline
- 2026-09-11: disclosed