CVE-2026-89722

A moderate severity flaw was found in the Linux kernel PCI/sysfs legacy I/O support as shipped in Red Hat Enterprise Linux (kernel and kernel-rt) and in the RHEL CoreOS kernels used by OpenShift Container Platform 4.x and 5.x. The pci_write_legacy_io() function unconditionally loads a 32-bit value from the kernfs write buffer regardless of how many bytes userspace actually wrote, so a local user with root privileges who writes 1 or 2 bytes to the legacy_io sysfs file causes the kernel to read up to 2 bytes past the end of the allocated buffer. This out-of-bounds read can result in limited disclosure of kernel heap memory or system instability. On little-endian PowerPC systems (POWER8 and later), the related byte-ordering error can additionally cause an out-of-bounds write of one byte. Exposure is limited by the fact that the legacy_io file is root-only and exists only on the Alpha and PowerPC architectures, the only architectures that define HAVE_PCI_LEGACY. Red Hat rated this flaw Moderate severity with a CVSS 3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting primarily availability impact. Because the impact is moderate and the CVSS score is below 7.0, the fix for the affected Red Hat Enterprise Linux and OpenShift Container Platform streams is deferred and no updates are currently planned; the residual risk is limited to local denial of service or minor information disclosure by an already-privileged root user on the affected architectures.