Executive brief
The Linux kernel's PCI subsystem allows privileged users to bypass kernel lockdown restrictions when accessing legacy I/O and memory device files. This enables a root user to directly program hardware devices and modify kernel memory regions that should be protected when the kernel is in a locked-down state, potentially leading to privilege escalation or system compromise.
Technical details
The vulnerability is a missing security lockdown check in the PCI sysfs handlers for legacy I/O and memory access. Specifically, the functions pci_write_legacy_io(), pci_mmap_legacy_mem(), and pci_mmap_legacy_io() in drivers/pci/pci-sysfs.c did not invoke security_locked_down(LOCKDOWN_PCI_ACCESS) before allowing access to legacy_io and legacy_mem sysfs files. This is inconsistent with earlier fixes to pci_write_config(), pci_mmap_resource(), and pci_write_resource_io() which added the same check. An attacker with root privileges can exploit this to write arbitrary I/O ports and map legacy memory spaces, circumventing kernel lockdown protections designed to prevent DMA-capable hardware programming. The fix adds the missing lockdown checks to all three legacy handlers. No known public exploit exists at the time of disclosure.
Affected products
- Linux Linux Kernel Multiple versions prior to the fix (commit 747b9bbbbdfdee51aee2456388f9b94b5086de4d)
Timeline
- 2026-09-17: disclosed: CVE-2026-90315 published on NVD
- 2026-08-04: patched: Fix committed upstream (commit 747b9bbbbdfdee51aee2456388f9b94b5086de4d) by Bjorn Helgaas