CVE-2026-89751 — x86/tdx: Fix off-by-one in port I/O handling

Back Back to CVE browser

MEDIUM

x86/tdx: Fix off-by-one in port I/O handling

Published Sep 11, 2026

5.5

MEDIUM

CVSS 3.1

EPSS 0.21%

Description

handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c use:

u64 mask = GENMASK(BITS_PER_BYTE * size, 0);

GENMASK(h, l) includes bit h. For size=1 (INB), this produces GENMASK(8, 0) = 0x1FF (9 bits) instead of GENMASK(7, 0) = 0xFF (8 bits). The mask is one bit too wide for all I/O sizes.

Fix the mask calculation.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  5.19
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <5.19
- Version
  6.1.188
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.12.109
  Status
  unaffected
  Constraints
  <=6.12.*
- Version
  6.18.50
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  6.6.157
  Status
  unaffected
  Constraints
  <=6.6.*
- Version
  7.2.4
  Status
  unaffected
  Constraints
  <=7.2.*
- Version
  7.3-rc1
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
5.19	affected	-
0	unaffected	<5.19
6.1.188	unaffected	<=6.1.*
6.12.109	unaffected	<=6.12.*
6.18.50	unaffected	<=6.18.*
6.6.157	unaffected	<=6.6.*
7.2.4	unaffected	<=7.2.*
7.3-rc1	unaffected	<=*

Red Hat Enterprise Linux 10

kernel

Fix deferred
Red Hat Enterprise Linux 10

kernel-rt

Fix deferred
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Fix deferred
Red Hat Enterprise Linux 8

kernel-rt

Fix deferred
Red Hat Enterprise Linux 9

kernel

Fix deferred
Red Hat Enterprise Linux 9

kernel-rt

Fix deferred
Red Hat OpenShift Container Platform 4

openshift/ose-rhel-coreos-8

Not affected
Red Hat OpenShift Container Platform 4

openshift/ose-rhel-coreos-9

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 10	kernel-rt	Fix deferred	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 8	kernel-rt	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel-rt	Fix deferred	n/a
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-8	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-9	Fix deferred	n/a

Remediation

No remediation recorded yet.

Metrics

0.21% 0.00215

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00215

Score over time

Sep–Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.21% (0.00215)	10.75th	v5 (v2026.06.15)
Sep 12, 2026	0.17% (0.00168)	6.35th	v5 (v2026.06.15)

Weaknesses (1)

CWE-193

References (11)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-89751		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2532152		Issue Tracking
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89751.mbox
https://git.kernel.org/stable/c/0f63e656b1c679d32ac595de29d10c03efca6a25
https://git.kernel.org/stable/c/220011fe95fc78b2bc2d7d43893bc73957a5c811
https://git.kernel.org/stable/c/222b7005e4519f633b4cd666226256abbab46a1a
https://git.kernel.org/stable/c/bb45f705c4440dd3c689328319b88dd28770bbb8
https://git.kernel.org/stable/c/c4a22154870813d10aa0b4c734a574c726f9d4b0
https://git.kernel.org/stable/c/c6875423ad849ac234ab9812eb72f37ff8a490b4
https://nvd.nist.gov/vuln/detail/CVE-2026-89751
https://www.cve.org/CVERecord?id=CVE-2026-89751