Junglewise Threat Intelligence

CVE-2026-89751: Linux kernel x86/tdx off-by-one in port I/O handling

CVE-2026-89751 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's TDX (Trusted Domain Extensions) module contains an arithmetic error in port I/O operations that causes incorrect bit masking during hardware I/O reads and writes. This could result in data corruption or unexpected behavior when devices communicate with the CPU through port I/O channels, affecting system stability or potentially enabling unauthorized access to I/O data.

Technical details

The vulnerability is an off-by-one error in the GENMASK() macro usage within handle_in() and handle_out() functions in arch/x86/coco/tdx/tdx.c. The code uses GENMASK(BITS_PER_BYTE * size, 0) to create a bitmask for port I/O operations; however, GENMASK(h, l) includes bit h, making the mask one bit wider than intended. For example, with size=1 (8-bit I/O), it produces 0x1FF (9 bits) instead of 0xFF (8 bits). The fix subtracts 1 from the upper bound to produce the correct mask. This affects all I/O sizes and could permit unintended bits to be included or excluded in port I/O transactions. The vulnerability is local to the TDX implementation and requires execution context within a TDX guest environment.

Affected products

  • Linux Linux kernel Various (patched 2026-07-13)

Timeline

  • 2026-09-11: disclosed: Published to NVD
  • 2026-07-13: patched: Fix committed upstream and backported to stable branches

References

Related threats