Executive brief
The Linux kernel's TDX (Trusted Domain Extensions) module contains an arithmetic error in port I/O operations that causes incorrect bit masking during hardware I/O reads and writes. This could result in data corruption or unexpected behavior when devices communicate with the CPU through port I/O channels, affecting system stability or potentially enabling unauthorized access to I/O data.
Technical details
The vulnerability is an off-by-one error in the GENMASK() macro usage within handle_in() and handle_out() functions in arch/x86/coco/tdx/tdx.c. The code uses GENMASK(BITS_PER_BYTE * size, 0) to create a bitmask for port I/O operations; however, GENMASK(h, l) includes bit h, making the mask one bit wider than intended. For example, with size=1 (8-bit I/O), it produces 0x1FF (9 bits) instead of 0xFF (8 bits). The fix subtracts 1 from the upper bound to produce the correct mask. This affects all I/O sizes and could permit unintended bits to be included or excluded in port I/O transactions. The vulnerability is local to the TDX implementation and requires execution context within a TDX guest environment.
Affected products
- Linux Linux kernel Various (patched 2026-07-13)
Timeline
- 2026-09-11: disclosed: Published to NVD
- 2026-07-13: patched: Fix committed upstream and backported to stable branches