Improper access control in Linux kernel - CVE-2026-80867
Published: September 5, 2026
Vulnerability identifier: #VU147050
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80867
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to conduct DMA attacks.
The vulnerability exists due to improper access control in the Alpha-specific pci_mmap_resource() function when mapping PCI BARs while kernel lockdown is enabled. A local user can map a PCI BAR to conduct DMA attacks.
Affected software
Linux kernel
How to mitigate CVE-2026-80867
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/257b55dc3d18d7ef01f62a8ff7317871f7597e28
- https://git.kernel.org/stable/c/4de5ff924c0a8ef8166c1a68af9087826e1e8d61
- https://git.kernel.org/stable/c/6e368485a1ac19fbde0a8b6a332d4545ae72a8ac
- https://git.kernel.org/stable/c/78a228f0aa0e9eba31955950c8a40a9945e2c8bb
- https://git.kernel.org/stable/c/85f966b1120874fe530edec50d28373ceb06ebcd
- https://git.kernel.org/stable/c/94defb18ac792fd16407d5a52ad0d3f5055c4b43
- https://git.kernel.org/stable/c/c3234efe21d4198945492cf7dba6859476f0f6ff
- https://git.kernel.org/stable/c/ed2cd1fee0ed16a1c2dff49175e65c641eb8ae2b