CVE-2026-89722

A flaw was found in the Linux kernel's PCI/sysfs component. A local user with root privileges could trigger an out-of-bounds read in the pci_write_legacy_io() function by writing to the legacy_io sysfs file with a size less than four bytes. This improper handling of the write buffer can lead to memory corruption, potentially allowing for information disclosure or other system instability. On little-endian PowerPC systems, this could also result in an out-of-bounds write.

A moderate severity flaw was found in the Linux kernel PCI/sysfs legacy I/O support as shipped in Red Hat Enterprise Linux (kernel and kernel-rt) and in the RHEL CoreOS kernels used by OpenShift Container Platform 4.x and 5.x. The pci_write_legacy_io() function unconditionally loads a 32-bit value from the kernfs write buffer regardless of how many bytes userspace actually wrote, so a local user with root privileges who writes 1 or 2 bytes to the legacy_io sysfs file causes the kernel to read up to 2 bytes past the end of the allocated buffer. This out-of-bounds read can result in limited disclosure of kernel heap memory or system instability. On little-endian PowerPC systems (POWER8 and later), the related byte-ordering error can additionally cause an out-of-bounds write of one byte. Exposure is limited by the fact that the legacy_io file is root-only and exists only on the Alpha and PowerPC architectures, the only architectures that define HAVE_PCI_LEGACY. Red Hat rated this flaw Moderate severity with a CVSS 3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting primarily availability impact. Because the impact is moderate and the CVSS score is below 7.0, the fix for the affected Red Hat Enterprise Linux and OpenShift Container Platform streams is deferred and no updates are currently planned; the residual risk is limited to local denial of service or minor information disclosure by an already-privileged root user on the affected architectures.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.