CVE-2026-90315

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description Legacy I/O and memory sysfs handlers fail to verify security locked down(LOCKDOWN PCI ACCESS), leaving legacy io and legacy mem files unprotected during kernel lockdown. This allows a root user to write to arbitrary I/O ports and map legacy I/O and memory spaces, potentially enabling the programming of DMA-capable hardware to modify kernel code. The issue affects the pci write legacy io(), pci mmap legacy mem(), and pci mmap legacy io() functions on architectures defining HAVE PCI LEGACY, such as Alpha and PowerPC.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.