CVE-2026-80917

Received Received - Intake

NULL Pointer Dereference in Linux Kernel PCI Host-Generic Driver

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for every config access. The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration: Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [<c038db9c>] pci_generic_config_read+0x40/0xb0 [<c038da04>] pci_bus_read_config_dword+0x50/0xb0 [<c0391e94>] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec [<c039245c>] pci_scan_single_device+0xa4/0x11c [<c0392570>] pci_scan_slot+0x9c/0x23c [<c039388c>] pci_scan_child_bus_extend+0x58/0x2f4 [<c0393db0>] pci_scan_root_bus_bridge+0x64/0xe8 [<c0393e54>] pci_host_probe+0x20/0xc8 [<c03bc6f4>] pci_host_common_probe+0x144/0x1e4 Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c, move the CAM ops definition there as pci_generic_cam_ops (mirroring pci_generic_ecam_ops) and export it for pci-host-generic.c to reference. [mani: removed timestamp from log]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-80917

EUVD

EUVD-2026-75092

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.9.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference issue in the Linux kernel's PCI host-generic driver on 32-bit systems. It occurs when the CAM (legacy) PCI operations lack proper bus mapping callbacks, causing a crash during PCI bus enumeration when the system tries to read configuration space.

Detection Guidance

This vulnerability affects 32-bit Linux systems using the pci-host-cam-generic driver. Detection requires checking kernel logs for NULL pointer dereference errors during PCI bus enumeration. Look for oops messages or kernel panics related to pci_generic_config_read or pci_bus_read_config_dword.

Impact Analysis

This vulnerability can cause system crashes (kernel oops) during boot or PCI device enumeration on 32-bit systems using the pci-host-cam-generic driver. It may prevent the system from recognizing PCI devices or booting successfully.

Compliance Impact

This vulnerability is a Linux kernel issue causing a NULL pointer dereference on 32-bit systems during PCI bus enumeration. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel-level hardware access issues.

Mitigation Strategies

Apply the kernel patch that adds the ->add_bus and ->remove_bus callbacks to the CAM ops. Update to a kernel version containing the fix (6.9.7+). If immediate patching is not possible, avoid using pci-host-cam-generic on 32-bit systems or disable PCI enumeration until patched.

Hi! I’m here to help you understand CVE-2026-80917. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70