CVE intelligence

CVE-2026-90315

Vulnerability intelligence

Published Sep 17, 2026Sources checked Nov 3, 2026

N/ACVSS not listedScore unavailable

What this means

Review the available evidence

CVE-2026-90315. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-90315?

In the Linux kernel, the following vulnerability has been resolved:

PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers

Currently, the legacy I/O and memory sysfs handlers do not check security_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and legacy_mem files unprotected when the kernel is locked down.

Commit eb627e17727e ("PCI: Lock down BAR access when the kernel is locked down") added the check to pci_write_config(), pci_mmap_resource(), and pci_write_resource_io() to prevent userspace from programming DMA-capable hardware that could be used to modify kernel code, but did not cover the legacy handlers.

As a result, root can still write arbitrary I/O ports and map the legacy I/O and memory spaces while the kernel is locked down, which is the same capability the lockdown is meant to remove.

Add the same check to pci_write_legacy_io(), pci_mmap_legacy_mem(), and pci_mmap_legacy_io().

These generic handlers cover both architectures that define HAVE_PCI_LEGACY (such as Alpha and PowerPC).

[bhelgaas: add Link]

Source: NVD