Live › vulnerability › CVE-2026-98504
Go to dashboardIn the Linux kernel's PCI device tree code, the helpers that generate bus-range and interrupt-map properties dereference a bridge's subordinate bus pointer without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, a bridge with no secondary bus can trigger a NULL pointer dereference that hangs the system early in boot.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel from v6.15 onward with CONFIG_PCI_DYNAMIC_OF_NODES enabled, where a PCI bridge lacks an allocated secondary bus, for example when bus numbers are exhausted or not writable. Systems without that config option, or with kernels older than v6.15, are not reached by this path.
No product ranges from the sources yet.
CONFIG_PCI_DYNAMIC_OF_NODES enabled, for example with grep CONFIG_PCI_DYNAMIC_OF_NODES /boot/config-$(uname -r)uname -r; the regression appeared in v6.15 per the commit logEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
PCI: of_property: Omit bus properties without a subordinate bus
A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.g., if there are no available bus numbers or the bridge secondary/subordinate bus numbers are not writable.
The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference pdev->subordinate without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer dereference and early boot hang.
Generate 'bus-range' and 'interrupt-map' properties only when a subordinate bus exists. Keep the node and its remaining properties for bridges without one.
The problem was latent since 407d1a51921e ("PCI: Create device tree node for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create device tree PCI host bridge node"), which appeared in v6.15. Before 1f340724419e, of_pci_make_dev_node() returned early because the parent OF node was missing.
[bhelgaas: move pdev->subordinate test to callees, commit log]
This page as .md · .json · in your agent: get_signal("CVE-2026-98504")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.