CVE-2026-74491

Received Received - Intake

NULL bus dereference in Linux kernel of/address

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of_pci_range_parser_one() The bus matching rework made of_match_bus() return NULL for nodes with ranges/dma-ranges but no local #address-cells. parser_init() stored that NULL bus, and the range iterator later dereferenced it. Reject such nodes in parser_init(), leaving an explicit empty iterator for callers that ignore the init return, and make of_dma_get_max_cpu_address() honour the init failure so a rejected node cannot clamp the DMA limit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74491

EUVD

EUVD-2026-59684

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference bug in the Linux kernel's device tree (of/address) subsystem. It occurs when parsing PCI ranges in nodes that have ranges or dma-ranges properties but lack local #address-cells. The parser incorrectly stores a NULL bus value, which later causes a crash when the range iterator tries to use it.

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to a NULL bus dereference in the of/address subsystem. Detection requires checking the kernel version and examining kernel logs for related errors. Commands like 'uname -a' to check kernel version and 'dmesg | grep -i "of_pci_range_parser_one"' to search for related errors may help.

Impact Analysis

This flaw could lead to kernel crashes or instability when systems with affected PCI devices process device tree configurations. It may cause denial-of-service conditions or unexpected system behavior during boot or device initialization.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel issue related to NULL bus dereference in PCI range parsing. Compliance impacts would depend on system-specific configurations and usage rather than the vulnerability itself.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves this issue. Check with your Linux distribution for kernel updates addressing CVE-2026-74491 and apply them promptly.

Hi! I’m here to help you understand CVE-2026-74491. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70