CVE-2026-93206 - Vulnerability Details

- PCI/proc: Use file_ns_capable() when checking config space read access

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI/proc: Use file_ns_capable() when checking config space read access

proc_bus_pci_read() decides how much of the config space is readable based
on capable(CAP_SYS_ADMIN), which checks the credentials of the task calling
read(), not the credentials of the process that opened the file.

The sysfs equivalent, pci_read_config(), has checked the credentials of the
opening process since commit de139a339395 ("pci: check caps from sysfs file
open to read device dependent config space"), so a privileged process can
open the config space file and pass the file descriptor to an unprivileged
process (for example, a process running a KVM guest with an assigned
device), which can then read the entire config space. The check was
subsequently routed through the LSM framework in commit 47970b1b2aa6 ("pci:
use security_capable() when checking capablities during config space read")
and converted to the dedicated helper in commit ab0fa82b2df9 ("pci-sysfs:
use proper file capability helper function").

Thus, the two interfaces check the same capability against different
credentials. Checking the credentials of the task calling read() makes the
outcome depend on who reads rather than who opened, so the restriction is
bypassed whenever a more privileged process reads through the descriptor.
Checking the credentials recorded in file->f_cred settles the decision at
open() time and ties it to the file, where it cannot change with the
caller.

Use file_ns_capable() to check CAP_SYS_ADMIN against the credentials in
effect when the file was opened, bringing the procfs interface in line with
the sysfs behaviour.

As a result, a file descriptor opened by a privileged process and passed to
an unprivileged one now allows the entire config space to be read through
procfs, matching sysfs.

Published: 2026-09-24

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A kernel bug allows a privileged process to open a PCI configuration space file and hand its file descriptor to an unprivileged process, enabling that process to read the entire configuration space. The flaw arises because the procfs interface checks CAP_SYS_ADMIN against the credentials of the task reading the file rather than those recorded when the file was opened. This results in an improper control of access permissions (CWE‑284) and incorrect access control (CWE‑269). An attacker who can gain a privileged process that opens the config space file can thereby exfiltrate sensitive hardware information and potentially leverage that knowledge for further attacks.

Affected Systems

All Linux kernel releases prior to the commit that introduced file_ns_capable() checks (commit ab0fa82b2df9) are affected. The flaw exists in the core kernel and is not limited to a specific distribution or release branch.

Risk and Exploitability

The vulnerability is exploitable from local processes; an attacker must first have a process capable of opening the config space file with elevated privileges and then obtain the resulting file descriptor. It does not provide a remote code execution path. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low to moderate likelihood of exploitation in typical environments, though the potential impact is significant if the attacker can gain access to unprivileged processes.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 8a3a54aa3e65ed76f8560a387243a7738ae0cb1c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5c7ab4ca66f0880cffc3735555ea719dd5253726
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 53407535d49ec034e476121020b5c878f0d92e18
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e7730acd6a01c5931a3afb83639810ff2fb9cc92
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 77272b7fd0e472086fd626a1fcd11da625822cc2
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c2d4174f492458ecdcdef309243624999612d526
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6351e94076329dab517ea94c115e15c4d8459381
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f82f53e75eff382fc8f56b73279b54f7cf5a5c65

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8a3a54aa3e65ed76f8560a387243a7738ae0cb1c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5c7ab4ca66f0880cffc3735555ea719dd5253726)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,53407535d49ec034e476121020b5c878f0d92e18)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e7730acd6a01c5931a3afb83639810ff2fb9cc92)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,77272b7fd0e472086fd626a1fcd11da625822cc2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c2d4174f492458ecdcdef309243624999612d526)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6351e94076329dab517ea94c115e15c4d8459381)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f82f53e75eff382fc8f56b73279b54f7cf5a5c65)`	affected	code_commit	—
`[0,5.10.270)`	affected	semver	—
`[0,5.15.221)`	affected	semver	—
`[0,6.1.188)`	affected	semver	—
`[0,6.6.157)`	affected	semver	—
`[0,6.12.109)`	affected	semver	—
`[0,6.18.50)`	affected	semver	—
`[0,7.2.4)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the file_ns_capable() check for PCI config space handling in /proc
If an immediate kernel update is unavailable, restrict access to /proc/pci/*.config files by using a read‑only mount or disabling the PCI procfs entries for unprivileged users
Configure SELinux or AppArmor to deny the transfer of file descriptors from privileged processes to unprivileged ones, preventing the bypass of the capability check

Generated by OpenCVE AI on September 26, 2026 at 02:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00189.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/53407535d49ec034e476121020b5c878f0d92e18
https://git.kernel.org/stable/c/5c7ab4ca66f0880cffc3735555ea719dd5253726
https://git.kernel.org/stable/c/6351e94076329dab517ea94c115e15c4d8459381
https://git.kernel.org/stable/c/77272b7fd0e472086fd626a1fcd11da625822cc2
https://git.kernel.org/stable/c/8a3a54aa3e65ed76f8560a387243a7738ae0cb1c
https://git.kernel.org/stable/c/c2d4174f492458ecdcdef309243624999612d526
https://git.kernel.org/stable/c/e7730acd6a01c5931a3afb83639810ff2fb9cc92
https://git.kernel.org/stable/c/f82f53e75eff382fc8f56b73279b54f7cf5a5c65

History

Sat, 26 Sep 2026 03:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-269 CWE-284

Thu, 24 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use file_ns_capable() when checking config space read access proc_bus_pci_read() decides how much of the config space is readable based on capable(CAP_SYS_ADMIN), which checks the credentials of the task calling read(), not the credentials of the process that opened the file. The sysfs equivalent, pci_read_config(), has checked the credentials of the opening process since commit de139a339395 ("pci: check caps from sysfs file open to read device dependent config space"), so a privileged process can open the config space file and pass the file descriptor to an unprivileged process (for example, a process running a KVM guest with an assigned device), which can then read the entire config space. The check was subsequently routed through the LSM framework in commit 47970b1b2aa6 ("pci: use security_capable() when checking capablities during config space read") and converted to the dedicated helper in commit ab0fa82b2df9 ("pci-sysfs: use proper file capability helper function"). Thus, the two interfaces check the same capability against different credentials. Checking the credentials of the task calling read() makes the outcome depend on who reads rather than who opened, so the restriction is bypassed whenever a more privileged process reads through the descriptor. Checking the credentials recorded in file->f_cred settles the decision at open() time and ties it to the file, where it cannot change with the caller. Use file_ns_capable() to check CAP_SYS_ADMIN against the credentials in effect when the file was opened, bringing the procfs interface in line with the sysfs behaviour. As a result, a file descriptor opened by a privileged process and passed to an unprivileged one now allows the entire config space to be read through procfs, matching sysfs.
Title		PCI/proc: Use file_ns_capable() when checking config space read access
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/53407535d49ec034e476121020b5c878f0d92e18 https://git.kernel.org/stable/c/5c7ab4ca66f0880cffc3735555ea719dd5253726 https://git.kernel.org/stable/c/6351e94076329dab517ea94c115e15c4d8459381 https://git.kernel.org/stable/c/77272b7fd0e472086fd626a1fcd11da625822cc2 https://git.kernel.org/stable/c/8a3a54aa3e65ed76f8560a387243a7738ae0cb1c https://git.kernel.org/stable/c/c2d4174f492458ecdcdef309243624999612d526 https://git.kernel.org/stable/c/e7730acd6a01c5931a3afb83639810ff2fb9cc92 https://git.kernel.org/stable/c/f82f53e75eff382fc8f56b73279b54f7cf5a5c65

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T15:10:29.326Z

Updated: 2026-09-25T12:42:35.957Z

Reserved: 2026-09-17T16:02:15.093Z

Link: CVE-2026-93206

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T16:17:14.670

Modified: 2026-09-25T13:17:17.547

Link: CVE-2026-93206

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-26T02:45:02Z

Weaknesses

CWE-269
Improper Privilege Management
CWE-284
Improper Access Control

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object