Linux Accidentally Left Legacy I/O & Memory Handlers Open In Kernel Lockdown Mode - Phoronix

Articles & Reviews

News Archive

Forums

Premium Ad-Free<br>Contact

Popular Categories

Close

Articles & Reviews

News Archive

Forums

Premium

Contact

Categories

Computers Display Drivers Graphics Cards Linux Gaming Memory Motherboards Processors Software Storage Operating Systems Peripherals

Linux Accidentally Left Legacy I/O & Memory Handlers Open In Kernel Lockdown Mode

Written by Michael Larabel in Linux Security on 6 August 2026 at 09:50 AM EDT. 1 Comment

For nearly the past decade has been the kernel lockdown mode for tightening up kernel access from user-space such as when UEFI Secure Boot is enabled. The kernel lockdown mode restricts PCI BAR access, no writing to /dev/mem, and other restrictions so user-space can't can't modify the running kernel or access sensitive kernel memory. An oversight has allowed legacy I/O and memory interfaces via sysfs to remain open in lockdown mode, but a fix is on the way.

Back in 2022 there was a trivial lockdown bypass bug while the latest accident in the kernel lockdown arena is the legacy_io and legacy_mem sysfs interfaces for PCI devices have remained open (for root users) for writing even with kernel lockdown mode enabled. The legacy_io file is used to read/write for legacy port I/O while legacy_mem is used to access legacy PCI memory space.

Krzysztof Wilczyński explained in a patch queued into the PCI subsystem's "next" Git branch ahead of Linux 7.3 that lockdown checks were never added for the legacy I/O and memory handlers. That's been that way since 2019 when the code was originally added for locking down PCI BAR access when the kernel is in locked down mode.<br>"Currently, the legacy I/O and memory sysfs handlers do not check security_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and legacy_mem files unprotected when the kernel is locked down.

Commit eb627e17727e ("PCI: Lock down BAR access when the kernel is locked down") added the check to pci_write_config(), pci_mmap_resource(), and pci_write_resource_io() to prevent userspace from programming DMA-capable hardware that could be used to modify kernel code, but did not cover the legacy handlers.

As a result, root can still write arbitrary I/O ports and map the legacy I/O and memory spaces while the kernel is locked down, which is the same capability the lockdown is meant to remove."

The patch is in PCI's next Git branch for the upcoming Linux 7.3 merge window. As it's marked as a fix for the original 2019 PCI BAR patch, it's also likely it will get back-ported to existing stable Linux kernel versions as well.

1 Comment

Tweet

Qualcomm QCE Driver On The Chopping Block With ~48x Slower Than Armv8 Crypto Extensions<br>ML-KEM + X-Wing Patches Posted For Linux To Help With Post-Quantum Security<br>Linux AF_ALG Crypto Code Removing Zero-Copy Support Out Of Security Concerns<br>Dirty Frag Vulnerability Made Public Early: Root Privilege On All Distributions<br>Linux Out-Of-Bounds Access Fixed For Unprivileged Users With Specially Crafted Certs<br>AppArmor Enhancements Merged For Linux 7.0

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Valve Sponsors Work Bringing Open-Source RADV Driver To Windows<br>The First Open-Source Firmware Released For Modern AMD Ryzen AM5 Platform<br>Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted<br>Prominent Arch Linux Developer Resigns After 10 Year Run<br>Starling: A New Linux Desktop Written In Swift, Own Wayland Compositor & Written With AI<br>DRM Format Modifiers For Old AMD GPUs Coming With Linux 7.3: Thanks Valve<br>Steam On Linux Use Back Above 4% In July<br>FFmpeg 9.0 Released With More Vulkan Acceleration, Animated WebP & More AMD AMF

Linux Accidentally Left Legacy I/O & Memory Handlers Open In Kernel Lockdown Mode

Linux Wireless Maintainer Takes Firm Stance Against AI/LLM Generated Slop Patches

Page Alloc Hogger Lets You Better Stress Memory Behavior On Linux For Testing/Debugging

AMD GFX1171 Support Merged For Mesa 26.3

Qualcomm Proposes Synx For The Linux Kernel With "Significant" Power + Performance Benefits

Linux 7.3 To Fix Longstanding Gap In The Native Driver For Original Steam Controller

Rust Coreutils 0.10 Released With More Security Hardening, Increased GNU Compatibility

Mesa 26.2 Released With NVK Mesh Shader Support, Many Other Vulkan Improvements

Denial WM: New Wayland Compositor With Flutter Directly Embedded

Cloudflare Announces Open-Source Cloudflare OS As AI "Operating System"

Linux To...