All vulnerabilities
CVE-2026-98504

Linux: PCI: of_property: Omit bus properties without a subordinate bus

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in879c911f77b8a7862aa16079b04efc3fdc5d32ecAlso 8805840aad73df7146778be243a196d48b4f6430CVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 879c911f77b8a7862aa16079b04efc3fdc5d32ecLinuxCVE List
  • 8805840aad73df7146778be243a196d48b4f6430LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI: of_property: Omit bus properties without a subordinate bus

A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.g., if there are no available bus numbers or the bridge secondary/subordinate bus numbers are not writable.

The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference pdev->subordinate without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer dereference and early boot hang.

Generate 'bus-range' and 'interrupt-map' properties only when a subordinate bus exists. Keep the node and its remaining properties for bridges without one.

The problem was latent since 407d1a51921e ("PCI: Create device tree node for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create device tree PCI host bridge node"), which appeared in v6.15. Before 1f340724419e, of_pci_make_dev_node() returned early because the parent OF node was missing.

[bhelgaas: move pdev->subordinate test to callees, commit log]

Text from CVE List

Affected versions 12

  • Linuxaffected: 407d1a51921e9f28c1bcec647c2205925bd1fdab before ccd32fa3489cbe86a0b281da4447b4c7eadb3518CVE List
  • Linuxaffected: 407d1a51921e9f28c1bcec647c2205925bd1fdab before a6d97d10e49ae49026ae13af6c41634fce470a37CVE List
  • Linuxaffected: 407d1a51921e9f28c1bcec647c2205925bd1fdab before 879c911f77b8a7862aa16079b04efc3fdc5d32ecCVE List
  • Linuxaffected: 407d1a51921e9f28c1bcec647c2205925bd1fdab before aee774588abd78f75952fd34c3fa461bc46b62c2CVE List
  • Linuxaffected: 407d1a51921e9f28c1bcec647c2205925bd1fdab before 8805840aad73df7146778be243a196d48b4f6430CVE List
  • Linuxaffected: 6.6CVE List
  • Linuxunaffected: all versions before 6.6CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5