CVE-2026-90315 PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers
Root users can bypass kernel lockdown restrictions via legacy PCI sysfs handlers, potentially allowing arbitrary memory access and code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90315?
CVE-2026-90315 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers
Currently, the legacy I/O and memory sysfs handlers do not check security_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and legacy_mem files unprotected when the kernel is locked down.
Commit eb627e17727e ("PCI: Lock down BAR access when the kernel is locked down") added the check to pci_write_config(), pci_mmap_resource(), and pci_write_resource_io() to prevent userspace from programming DMA-capable hardware that could be used to modify kernel code, but did not cover the legacy handlers.
As a result, root can still write arbitrary I/O ports and map the legacy I/O and memory spaces while the kernel is locked down, which is the same capability the lockdown is meant to remove.
Add the same check to pci_write_legacy_io(), pci_mmap_legacy_mem(), and pci_mmap_legacy_io().
These generic handlers cover both architectures that define HAVE_PCI_LEGACY (such as Alpha and PowerPC).
[bhelgaas: add Link]
Which versions are affected by CVE-2026-90315?
How do I fix CVE-2026-90315?
Apply the vendor's patch.
Is CVE-2026-90315 being exploited?
There is no known exploitation of CVE-2026-90315 in the wild and no public exploit code.
Sources
Also known as AZL-103040, BELL-CVE-2026-90315, DEBIAN-CVE-2026-90315, GHSA-7fpw-g7p7-53qh, UBUNTU-CVE-2026-90315.