Riskcovery

CVE-2026-98504

PCI: of_property: Omit bus properties without a subordinate bus

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI: of_property: Omit bus properties without a subordinate bus

A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.g., if there are no available bus numbers or the bridge secondary/subordinate bus numbers are not writable.

The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference pdev->subordinate without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer dereference and early boot hang.

Generate 'bus-range' and 'interrupt-map' properties only when a subordinate bus exists. Keep the node and its remaining properties for bridges without one.

The problem was latent since 407d1a51921e ("PCI: Create device tree node for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create device tree PCI host bridge node"), which appeared in v6.15. Before 1f340724419e, of_pci_make_dev_node() returned early because the parent OF node was missing.

[bhelgaas: move pdev->subordinate test to callees, commit log]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 407d1a51921e9f28c1bcec647c2205925bd1fdab to before ccd32fa3489cbe86a0b281da4447b4c7eadb3518Affected
  • 407d1a51921e9f28c1bcec647c2205925bd1fdab to before a6d97d10e49ae49026ae13af6c41634fce470a37Affected
  • 407d1a51921e9f28c1bcec647c2205925bd1fdab to before 879c911f77b8a7862aa16079b04efc3fdc5d32ecAffected
  • 407d1a51921e9f28c1bcec647c2205925bd1fdab to before aee774588abd78f75952fd34c3fa461bc46b62c2Affected
  • 407d1a51921e9f28c1bcec647c2205925bd1fdab to before 8805840aad73df7146778be243a196d48b4f6430Affected
LinuxLinux
  • 6.6Affected
  • before 6.6Not affected
  • 6.6.158 through 6.6.*Not affected
  • 6.12.112 through 6.12.*Not affected
  • 6.18.55 through 6.18.*Not affected
  • 7.2.9 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.