CVE-2026-90315

A flaw was found in the Linux kernel's PCI/sysfs legacy I/O and memory handlers. These handlers failed to enforce kernel lockdown, a security mechanism designed to prevent privileged users from performing certain low-level operations. A local root user could exploit this by writing to arbitrary I/O ports and mapping legacy I/O and memory spaces, thereby bypassing the kernel lockdown. This bypass could allow the root user to perform actions that the lockdown feature is intended to restrict, potentially leading to a compromise of system integrity.

This vulnerability is rated as Important because it enables a privileged local user to subvert kernel lockdown protections, which are relied upon to preserve host integrity under Secure Boot. On affected systems enforcing integrity or confidentiality lockdown modes, an administrative account could directly interact with legacy PCI memory and port I/O interfaces that omit lockdown validation. Consequently, an attacker possessing local root access can compromise kernel integrity and circumvent hardware-enforced boundaries.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.