Linux kernel PCI/proc: config space read checked against the reader's credentials, not the opener's

Impact

proc_bus_pci_read() decided how much of PCI config space to expose using capable(CAP_SYS_ADMIN), which tests the credentials of whoever calls read() rather than the process that opened the file. The sysfs equivalent has checked the opener's credentials for years, so the two interfaces applied the same capability to different subjects and the procfs restriction could be bypassed - or, in the passed-descriptor direction, a descriptor opened by a privileged helper and handed to an unprivileged process behaved inconsistently between the two paths. This matters on nodes doing GPU or NIC passthrough, where a privileged supervisor opens device files and hands descriptors to a less privileged VMM holding an assigned device. The fix uses file_ns_capable() so the decision is settled at open() time and tied to the file, matching sysfs. The effect is config space read visibility, not write access or code execution.

Who can reach it

Local only, and only where a privileged process opens /proc/bus/pci config space and passes the descriptor to a lower-privileged process - the assigned-device VMM pattern is the concrete case. Not reachable over the network and not reachable by a tenant confined to a container without that descriptor.

What to do

Pick up the fix from your distribution's stable kernel; it is in the mainline stable branches (see the git.kernel.org commits). Applying it means booting the new kernel, so each node has to be drained and rebooted. There is no runtime mitigation other than not passing PCI config space descriptors across a privilege boundary.

References

Related entries

• Linux kernel SCSI core: blocking tag allocation during error recovery can deadlock the EH threadCVE-2026-93781 · Linux kernel SCSI core (scsi_eh_lock_door tag allocation)Unscored
• Linux kernel BPF: sysctl value replaced by a BPF program is not NUL-terminated, giving out-of-bounds readsCVE-2026-97420 · Linux kernel BPF (bpf_sysctl_set_new_value replacement buffer)Unscored
• Linux kernel net/rds: unprivileged container reads every RDS socket and connection on the hostCVE-2026-97476 · Linux kernel net/rds RDS_INFO_* getsockopt (missing netns filtering)Unscored
• Linux kernel net/rds: RDS-over-IB shutdown sleeps in a shared worker and hangs fabric teardownCVE-2026-97491 · Linux kernel net/rds over InfiniBand (rds_ib_conn_path_shutdown sleeping in the shutdown worker)Unscored
• Linux PCI sysfs: BAR resize via resourceN_resize had no CAP_SYS_ADMIN checkCVE-2026-97505 · Linux kernel PCI sysfs (resourceN_resize, __resource_resize_store)Unscored
• Linux kernel qla2xxx: unvalidated FC BSG request length causes out-of-bounds heap readsCVE-2026-97529 · Linux kernel qla2xxx (FC BSG vendor command request_len validation)Unscored