Linux x86/tdx: off-by-one GENMASK makes the port I/O value mask one bit too wide in a TDX guest

Impact

handle_in() and handle_out() in the TDX guest code built their value mask with GENMASK(BITS_PER_BYTE * size, 0), and GENMASK includes the high bit, so a 1-byte INB produced a 9-bit 0x1FF mask instead of 0xFF. The mask is one bit too wide for every I/O size, meaning one extra bit of the untrusted host-supplied value passes through to the guest on input, and one extra bit leaves the guest on output. This lives on the guest's boundary with the untrusted VMM, which is the whole point of TDX - operators running confidential-computing GPU instances rely on that boundary being tight. The record describes only the mask arithmetic and does not characterize an exploit path or assign a score; treat this as a confidential-computing hardening fix rather than a demonstrated escape.

Who can reach it

The untrusted hypervisor or VMM, on the port I/O path into a TDX guest. Only Intel TDX guests are affected; a bare-metal or non-TDX host kernel does not run this code.

What to do

Patch the guest kernel image used for TDX confidential instances and reboot those guests; the fix is confined to arch/x86/coco/tdx/tdx.c. Host kernels and firmware need no change. No mitigation is named in the record.

References

Related entries

• Linux memcg: concurrent memory.max writers reclaim toward a stale target and can loop indefinitelyCVE-2026-89752 · Linux kernel memcg (memory.high / memory.max writer reclaim loop)Unscored
• Linux mm/vmscan: direct reclaim never reports an RCU-tasks quiescent state, stalling rcu_tasks under memory pressureCVE-2026-89753 · Linux kernel mm/vmscan (shrink_lruvec RCU-tasks quiescent state)Unscored
• Linux kernel mm/migrate: long page-migration batches stall Tasks-RCU grace periods on KVM hostsCVE-2026-89756 · Linux kernel mm/migrate (migrate_pages_batch RCU-tasks quiescent state)Unscored
• Linux kernel DAMON: merge-threshold overflow can spin kdamond in an infinite in-kernel loopCVE-2026-89796 · Linux kernel mm/damon/core (kdamond_merge_regions threshold overflow)Unscored
• Linux qla2xxx: D_Port diagnostics copies uninitialized kernel heap bytes to user spaceCVE-2026-89859 · Linux kernel qla2xxx (D_Port diagnostics response buffer)Unscored
• KVM on s390: uninitialized stack bytes in injected pfault interrupt state readable via migration ioctlsCVE-2026-89921 · Linux kernel KVM/s390 (inject_pfault_token interrupt injection)Unscored