{"id":"CVE-2026-98504","kind":"vulnerability","aliases":["CVE-2026-98504"],"related":[],"title":"Linux kernel: PCI bridge without subordinate bus causes boot-time NULL dereference","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: of_property: Omit bus properties without a subordinate bus\n\nA bridge (a device with a Type 1 header) may not have a secondary bus\nallocated (pdev->subordinate), e.g., if there are no available bus numbers\nor the bridge secondary/subordinate bus numbers are not writable.\n\nThe dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map()\ndereference pdev->subordinate without checking it.  When\nCONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer\ndereference and early boot hang.\n\nGenerate 'bus-range' and 'interrupt-map' properties only when a subordinate\nbus exists.  Keep the node and its remaining properties for bridges without\none.\n\nThe problem was latent since 407d1a51921e (\"PCI: Create device tree node\nfor bridge\"), but wasn't reachable until 1f340724419e (\"PCI: of: Create\ndevice tree PCI host bridge node\"), which appeared in v6.15.  Before\n1f340724419e, of_pci_make_dev_node() returned early because the parent OF\nnode was missing.\n\n[bhelgaas: move pdev->subordinate test to callees, commit log]","summary":"In the Linux kernel's PCI device tree code, the helpers that generate bus-range and interrupt-map properties dereference a bridge's subordinate bus pointer without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, a bridge with no secondary bus can trigger a NULL pointer dereference that hangs the system early in boot.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["device-tree","infrastructure","linux-kernel","pci"],"not_affected_if":["default-config","kernel-before-6.15"],"how_to_check":"- Check whether the running kernel has `CONFIG_PCI_DYNAMIC_OF_NODES` enabled, for example with `grep CONFIG_PCI_DYNAMIC_OF_NODES /boot/config-$(uname -r)`\n- Check the kernel version with `uname -r`; the regression appeared in v6.15 per the commit log","fix":"- Move to a kernel build that includes the upstream fix (the commit titled 'PCI: of_property: Omit bus properties without a subordinate bus'); the sources do not give a fixed version number: unknown\n- Until patched, unknown workaround: the sources do not say","status":"open","published_at":"2026-10-18T16:17:01+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:31+00:00","updated_at":"2026-10-25T05:25:31+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:25:31Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a kernel build that includes the upstream fix (the commit titled 'PCI: of_property: Omit bus properties without a subordinate bus'); the sources do not give a fixed version number: unknown\n- Until patched, unknown workaround: the sources do not say","reach":"local","title":"Linux kernel: PCI bridge without subordinate bus causes boot-time NULL dereference","impact":"low","summary":"In the Linux kernel's PCI device tree code, the helpers that generate bus-range and interrupt-map properties dereference a bridge's subordinate bus pointer without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, a bridge with no secondary bus can trigger a NULL pointer dereference that hangs the system early in boot.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","pci","device-tree"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Early boot hang from a kernel NULL pointer dereference","analyst_note":"Confirm the affected kernel version range and the fixed stable release from the NVD entry or kernel.org stable commit.","how_to_check":"- Check whether the running kernel has `CONFIG_PCI_DYNAMIC_OF_NODES` enabled, for example with `grep CONFIG_PCI_DYNAMIC_OF_NODES /boot/config-$(uname -r)`\n- Check the kernel version with `uname -r`; the regression appeared in v6.15 per the commit log","needs_analyst":true,"not_affected_if":["default-config","kernel-before-6.15"],"who_is_affected":"Systems running a Linux kernel from v6.15 onward with CONFIG_PCI_DYNAMIC_OF_NODES enabled, where a PCI bridge lacks an allocated secondary bus, for example when bus numbers are exhausted or not writable. Systems without that config option, or with kernels older than v6.15, are not reached by this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00073,"input_tokens":3652,"output_tokens":729,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98504':16A,19A '1':113C '1f340724419e':225C,240C '407d1a51921e':212C 'alloc':121C 'appear':236C 'avail':129C 'bhelgaa':255C 'boot':10A,85B,179C 'boot-tim':9A 'bridg':4A,51B,68B,107C,134C,204C,219C,233C 'bus':7A,42B,54B,72B,100C,105C,120C,130C,136C,148C,183C,194C 'bus-rang':41B,182C 'calle':261C 'caus':8A,172C 'check':57B,160C 'code':36B 'commit':262C 'config':60B,163C 'creat':214C,228C 'cve':14A,17A 'derefer':13A,49B,78B,156C,176C 'dev':244C 'devic':21B,34B,109C,215C,229C 'device-tre':20B 'dynam':62B,142C,165C 'e.g':124C 'earli':83B,178C,247C 'enabl':66B,169C 'exist':195C 'follow':91C 'generat':40B,181C 'hang':80B,180C 'header':114C 'helper':38B,144C 'host':232C 'infrastructur':23B 'interrupt':46B,187C 'interrupt-map':45B,186C 'intr':154C 'keep':196C 'kernel':2A,26B,31B,89C 'latent':210C 'linux':1A,25B,30B,88C 'linux-kernel':24B 'log':263C 'make':243C 'map':47B,155C,188C 'may':115C 'miss':254C 'move':256C 'node':64B,167C,198C,217C,234C,245C,252C 'null':12A,76B,174C 'number':131C,137C 'omit':99C 'one':206C 'parent':250C 'pci':3A,27B,33B,61B,96C,146C,152C,164C,213C,226C,231C,242C 'pdev':122C,157C,257C 'pointer':55B,77B,175C 'problem':208C 'prop':147C,153C 'properti':48B,98C,101C,189C,202C 'rang':43B,149C,184C 'reachabl':223C 'remain':201C 'resolv':95C 'return':246C 'secondari':71B,119C 'secondary/subordinate':135C 'sinc':211C 'subordin':6A,53B,104C,123C,158C,193C,258C 'system':82B 'test':259C 'time':11A 'tree':22B,35B,216C,230C 'trigger':74B 'type':112C 'v6.15':238C 'vulner':92C 'wasn':221C 'without':5A,56B,102C,159C,205C 'writabl':140C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel from v6.15 onward with CONFIG_PCI_DYNAMIC_OF_NODES enabled, where a PCI bridge lacks an allocated secondary bus, for example when bus numbers are exhausted or not writable. Systems without that config option, or with kernels older than v6.15, are not reached by this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98504","severity":null,"published_at":"2026-10-18T16:17:01+00:00","modified_at":"2026-10-19T10:19:03+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}