CVE-2026-97505

A flaw was found in the Linux kernel. Missing authorization checks in the PCI sysfs interface can allow a local user to cause a denial of service (DoS). The kernel fails to verify administrative capabilities when resizing a device Base Address Register (BAR), relying only on basic file access permissions. A local user with write access to the sysfs resize attribute can alter PCI device configurations, disrupting active device drivers.

This vulnerability is rated as Moderate impact because exploitation requires local access and write permissions to the PCI sysfs device attributes, limiting the attack surface under standard configurations. On default Red Hat Enterprise Linux installations, sysfs interfaces are writable only by the root user, preventing unprivileged accounts from initiating resize operations. If write permissions are delegated or misconfigured, an attacker could disrupt running device drivers and induce a local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.