Linux PCI sysfs: BAR resize via resourceN_resize had no CAP_SYS_ADMIN check

Impact

Writing the resourceN_resize sysfs attribute reprograms a PCI device's BAR size, and the kernel gated it only on file permissions rather than on CAP_SYS_ADMIN. Anyone who could open that file for writing could change the BAR layout of a live device and disrupt the driver bound to it. That matters on GPU and DPU nodes because resizable BARs are exactly what large-VRAM accelerators and NICs use, and a resize under an active driver is a device-level disruption that typically ends in a node reboot, not a clean recovery. In practice the sysfs file is root-owned on a default system, so exposure depends on whether anything in your stack loosens those permissions or hands the file to a less privileged agent.

Who can reach it

Local, and only for a user or container that has been given write access to /sys/bus/pci/devices/*/resourceN_resize. Default permissions already restrict this to root, so this is a defence-in-depth fix for hosts where sysfs ownership has been relaxed.

What to do

Pick up a stable kernel with the CAP_SYS_ADMIN check (three stable commits listed) on your next kernel roll and reboot the node. In the meantime confirm nothing but root can write PCI resize attributes on your hosts - that check costs nothing and closes the reachable case. No fixed distro version is named in the record.

References

Related entries

• Linux kernel qla2xxx: unvalidated FC BSG request length causes out-of-bounds heap readsCVE-2026-97529 · Linux kernel qla2xxx (FC BSG vendor command request_len validation)Unscored
• Linux kernel qla2xxx: FC frame payload aliasing 0xDEADDEAD spins the interrupt handler into a CPU soft lockupCVE-2026-97530 · Linux kernel qla2xxx (continuation IOCB signature poll in interrupt context)Unscored
• Linux qla2xxx: double free and NULL dma_pool use when adapter memory allocation fails at probeCVE-2026-97532 · Linux kernel scsi qla2xxx (qla2x00_mem_alloc error path, dangling pointers)Unscored
• Linux kernel qla2xxx: NPIV virtual-port index above 128 writes past the VP control IOCB bitmapCVE-2026-97535 · Linux kernel qla2xxx (VP_CTRL IOCB vp_idx_map bounds)Unscored
• Linux qla2xxx: NULL dma_free and mismatched bitmap locking in multiqueue queue teardownCVE-2026-97537 · Linux kernel scsi qla2xxx (multiqueue req/rsp queue teardown, qid bitmap locking)Unscored
• Linux kernel io_uring: MSG_TRUNC recv over-advances the provided buffer ringCVE-2026-97618 · Linux kernel io_uring/net (provided buffer ring accounting with MSG_TRUNC)Unscored