The Linux kernel vulnerability CVE-2026-89722 involved an out-of-bounds read in pci_write_legacy_io() due to unconditional 4-byte loads from a write buffer regardless of the actual write size (1, 2, or 4 bytes). The kernfs write buffer allocation allowed a 1-byte write to allocate 2 bytes, but the code read up to 2 bytes beyond the allocation, causing slab-out-of-bounds reads detected by KASAN. The fix uses get_unaligned_le16() and get_unaligned_le32() to read the exact number of bytes requested, interpreting the buffer as little-endian to match PCI I/O port space byte ordering. Additionally, PowerPC-specific byte shifting was corrected to handle little-endian PowerPC properly, removing incorrect shifts that caused out-of-bounds writes or reversed bytes. The legacy_io sysfs file is root-only and only exists on Alpha and PowerPC architectures, limiting exposure.

The vulnerability results in out-of-bounds memory reads and, on little-endian PowerPC systems, out-of-bounds writes. These memory errors could potentially lead to kernel instability or information disclosure. However, the legacy_io sysfs file is root-only and limited to Alpha and PowerPC architectures, reducing the attack surface. There are no known exploits in the wild.

A fix has been implemented in the Linux kernel source code to correctly handle the number of bytes read from the write buffer and to address byte ordering issues on PowerPC architectures. Users should update to the fixed kernel version once available. Since this affects a root-only interface on specific architectures, no additional mitigation is indicated.