The vulnerability stems from the legacy I/O and memory sysfs handlers in the Linux kernel not performing a lockdown check (security_locked_down(LOCKDOWN_PCI_ACCESS)), which is meant to restrict hardware access when the kernel is in lockdown mode. As a result, even when the kernel is locked down, a privileged user can still write arbitrary I/O ports and map legacy I/O and memory spaces, allowing manipulation of DMA‐capable hardware and potentially modification of kernel code. This flaw undermines the intended security boundary enforced by kernel lockdown and can be abused to compromise kernel integrity.

All versions of the Linux kernel that implement legacy PCI I/O and memory handlers—specifically those on architectures that define HAVE_PCI_LEGACY such as Alpha and PowerPC—are affected. The issue persists until the kernel includes the patch that adds the lockdown check to pci_write_legacy_io(), pci_mmap_legacy_mem(), and pci_mmap_legacy_io().

The EPSS score is reported as < 1%, indicating a very low probability of exploitation in the wild. Because the flaw only affects actions that require root privileges or a corrupting process with equivalent rights, the risk for general or remote attackers remains minimal. Nonetheless, the vulnerability demonstrates a failure of the kernel lockdown mechanism, which is critical for protecting systems that rely on this feature. The CISA KEV catalog does not list this issue, further suggesting that known exploits are not currently available.