CVE-2026-72487

Received Received - Intake

PCI ROM Header Validation Flaw in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr before accessing We meet a crash when running stress-ng on x86_64 machine: BUG: unable to handle page fault for address: ffa0000007f40000 RIP: 0010:pci_get_rom_size+0x52/0x220 Call Trace: <TASK> pci_map_rom+0x80/0x130 pci_read_rom+0x4b/0xe0 kernfs_file_read_iter+0x96/0x180 vfs_read+0x1b1/0x300 Our analysis reveals that the ROM space's start address is 0xffa0000007f30000, and size is 0x10000. Because of broken ROM space, before calling readl(pds), the pds's value is 0xffa0000007f3ffff, which is already pointed to the ROM space end, invoking readl() would read 4 bytes therefore cause an out-of-bounds access and trigger a crash. Fix this by adding image header and data structure checking. We also found another crash on arm64 machine: Unable to handle kernel paging request at virtual address ffff8000dd1393ff Mem abort info: ESR = 0x0000000096000021 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault The call trace is the same with x86_64, but the crash reason is that the data structure addr is not aligned with 4, and arm64 machine report "alignment fault". Fix this by adding alignment checking. [bhelgaas: shorten function names, wrap comments]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72487

EUVD

EUVD-2026-59386

Affected Vendors & Products

Vendor	Product	Version / Range
stress-ng	stress-ng	*
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a crash when accessing PCI ROM space due to missing checks on the ROM header and data structure address. On x86_64, an out-of-bounds memory access occurs because the ROM space end address is incorrectly used, causing a page fault. On arm64, an alignment fault happens when the data structure address is not aligned to 4 bytes.

Detection Guidance

This vulnerability manifests as a kernel crash due to improper PCI ROM header or data structure access. Detect it by monitoring kernel logs for page faults or alignment errors related to PCI ROM operations. Check dmesg output for errors like 'unable to handle page fault' or 'alignment fault' after PCI device operations.

Impact Analysis

This vulnerability can cause system crashes when accessing certain PCI devices, leading to kernel panics and potential denial of service. Systems using affected Linux kernel versions may become unstable or reboot unexpectedly during operations involving PCI ROM access.

Compliance Impact

This vulnerability causes kernel crashes due to improper PCI ROM header and data structure validation, leading to memory access errors. While it does not directly impact GDPR or HIPAA compliance, such crashes could disrupt system availability, potentially violating availability requirements in these regulations.

Mitigation Strategies

Apply the Linux kernel patch that adds ROM header and data structure validation. Update to a fixed kernel version where pci_get_rom_size includes proper checks for ROM space start address and alignment. Monitor system stability after applying the patch.

Hi! I’m here to help you understand CVE-2026-72487. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70