---
id: "CVE-2026-98504"
kind: "vulnerability"
aliases: ["CVE-2026-98504"]
title: "Linux kernel: PCI bridge without subordinate bus causes boot-time NULL dereference"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["device-tree", "infrastructure", "linux-kernel", "pci"]
not_affected_if: ["default-config", "kernel-before-6.15"]
published_at: "2026-10-18T16:17:01+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:25:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98504", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel: PCI bridge without subordinate bus causes boot-time NULL dereference

In the Linux kernel's PCI device tree code, the helpers that generate bus-range and interrupt-map properties dereference a bridge's subordinate bus pointer without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, a bridge with no secondary bus can trigger a NULL pointer dereference that hangs the system early in boot.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the running kernel has `CONFIG_PCI_DYNAMIC_OF_NODES` enabled, for example with `grep CONFIG_PCI_DYNAMIC_OF_NODES /boot/config-$(uname -r)`
- Check the kernel version with `uname -r`; the regression appeared in v6.15 per the commit log

## Fix

- Move to a kernel build that includes the upstream fix (the commit titled 'PCI: of_property: Omit bus properties without a subordinate bus'); the sources do not give a fixed version number: unknown
- Until patched, unknown workaround: the sources do not say

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98504

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

PCI: of_property: Omit bus properties without a subordinate bus

A bridge (a device with a Type 1 header) may not have a secondary bus
allocated (pdev->subordinate), e.g., if there are no available bus numbers
or the bridge secondary/subordinate bus numbers are not writable.

The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map()
dereference pdev->subordinate without checking it.  When
CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer
dereference and early boot hang.

Generate 'bus-range' and 'interrupt-map' properties only when a subordinate
bus exists.  Keep the node and its remaining properties for bridges without
one.

The problem was latent since 407d1a51921e ("PCI: Create device tree node
for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create
device tree PCI host bridge node"), which appeared in v6.15.  Before
1f340724419e, of_pci_make_dev_node() returned early because the parent OF
node was missing.

[bhelgaas: move pdev->subordinate test to callees, commit log]

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_