CVE-2026-80651
Received Received - Intake

Kernel NULL Pointer Dereference in AMD SEV-TSM Driver

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev->bus is NULL dsm_create() initially checks pdev->bus when computing segment_id: u8 segment_id = pdev->bus ? pci_domain_nr(pdev->bus) : 0; But the next two lines unconditionally dereference pdev->bus via pcie_find_root_port() and especially pci_dev_id(pdev), which expands to PCI_DEVID(dev->bus->number, dev->devfn). If pdev->bus is in fact NULL, segment_id is initialised to 0 but the very next statement crashes the kernel. smatch flags this: drivers/crypto/ccp/sev-dev-tsm.c:253 dsm_create() error: we previously assumed 'pdev->bus' could be null (see line 251) Make the NULL handling consistent: if pdev->bus is NULL the device has no PCI context to work with and SEV TIO setup cannot proceed, so return -ENODEV before any of the bus-dependent lookups. The remaining initialisation now runs only on the path where pdev->bus is known to be valid. No change for callers where pdev->bus is non-NULL, which is the only case where dsm_create() did meaningful work before this change.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80651
EUVD
EUVD-2026-67527

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the crypto subsystem, specifically in the CCP (Cryptographic Coprocessor) SEV (Secure Encrypted Virtualization) device driver. The issue occurs in the dsm_create() function where it fails to properly handle a NULL pointer for pdev->bus. The function checks if pdev->bus is NULL to set segment_id but then unconditionally dereferences pdev->bus in subsequent operations, leading to a kernel crash if pdev->bus is NULL.

Detection Guidance

This vulnerability is specific to the Linux kernel's crypto subsystem (ccp/sev-dev-tsm) and requires kernel-level detection. Check kernel logs for crashes or errors related to ccp or sev-dev-tsm modules. Use commands like dmesg | grep -i ccp or journalctl -k | grep -i sev-dev-tsm to inspect kernel messages.

Impact Analysis

If exploited, this vulnerability could cause a kernel crash (denial of service) on systems using the affected Linux kernel component. Systems relying on SEV TIO (Trusted I/O) features may become unstable or unresponsive, potentially disrupting cryptographic operations and virtualization security.

Compliance Impact

This vulnerability is a kernel crash due to improper NULL pointer handling in PCI bus access for SEV TIO setup. It does not directly affect data privacy or security controls required by GDPR or HIPAA, as it only causes system instability in specific PCI device contexts.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If the vulnerability is present, update to a patched kernel version. Disable the ccp module if not needed using modprobe -r ccp. Monitor kernel logs for errors after applying fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80651. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart