CVE-2026-89751

Received Received - Intake

Off-by-One in Linux Kernel TDX Port I/O Handling

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASK(BITS_PER_BYTE * size, 0); GENMASK(h, l) includes bit h. For size=1 (INB), this produces GENMASK(8, 0) = 0x1FF (9 bits) instead of GENMASK(7, 0) = 0xFF (8 bits). The mask is one bit too wide for all I/O sizes. Fix the mask calculation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89751

EUVD

EUVD-2026-76663

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where port I/O handling functions for Intel TDX (Trusted Execution Environment) use an incorrect bitmask. The functions handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c create a mask that is one bit too wide for all I/O sizes due to an off-by-one error in GENMASK usage. For size=1 (INB instruction), it generates a 9-bit mask instead of an 8-bit mask.

Detection Guidance

This vulnerability is specific to the Linux kernel's TDX (Trust Domain Extensions) implementation and affects port I/O handling in x86 systems. Detection requires checking the kernel version and examining the vulnerable code in arch/x86/coco/tdx/tdx.c. No network-specific detection commands are applicable.

Impact Analysis

This vulnerability could allow unintended access to I/O ports, potentially leading to data leaks or system instability. It specifically affects systems using Intel TDX technology, which is used for secure enclaves. Exploitation might enable privilege escalation or denial of service on vulnerable systems.

Mitigation Strategies

Apply the kernel patch that fixes the off-by-one error in port I/O handling. Update to a patched kernel version where the mask calculation in handle_in() and handle_out() is corrected to GENMASK(7, 0) for size=1 (INB).

Hi! I’m here to help you understand CVE-2026-89751. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70