CVE-2026-98504
Received Received - Intake

Null Pointer Dereference in Linux Kernel PCI Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Omit bus properties without a subordinate bus A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.g., if there are no available bus numbers or the bridge secondary/subordinate bus numbers are not writable. The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference pdev->subordinate without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer dereference and early boot hang. Generate 'bus-range' and 'interrupt-map' properties only when a subordinate bus exists. Keep the node and its remaining properties for bridges without one. The problem was latent since 407d1a51921e ("PCI: Create device tree node for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create device tree PCI host bridge node"), which appeared in v6.15. Before 1f340724419e, of_pci_make_dev_node() returned early because the parent OF node was missing. [bhelgaas: move pdev->subordinate test to callees, commit log]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98504
EUVD
EUVD-2026-103744

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux 407d1a51921e9f28c1bcec647c2205925bd1fdab
Linux Linux 407d1a51921e9f28c1bcec647c2205925bd1fdab
Linux Linux 407d1a51921e9f28c1bcec647c2205925bd1fdab
Linux Linux 407d1a51921e9f28c1bcec647c2205925bd1fdab
Linux Linux 407d1a51921e9f28c1bcec647c2205925bd1fdab
Linux Linux 6.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where PCI bridge properties are incorrectly generated when no subordinate bus exists. The functions of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference a null pointer (pdev->subordinate) without checking, causing a NULL pointer dereference and system hang during early boot if CONFIG_PCI_DYNAMIC_OF_NODES is enabled.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires checking kernel logs for NULL pointer dereference errors during boot, particularly when CONFIG_PCI_DYNAMIC_OF_NODES is enabled. Monitor system logs for early boot failures or hangs related to PCI bridge initialization.

Impact Analysis

This vulnerability can cause your system to fail to boot properly, resulting in a crash or hang during the early boot process. It specifically affects systems using PCI bridges with the Linux kernel and the CONFIG_PCI_DYNAMIC_OF_NODES configuration enabled.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If immediate patching is not possible, disable CONFIG_PCI_DYNAMIC_OF_NODES in the kernel configuration to prevent the NULL pointer dereference. Ensure your system uses a kernel version that includes the fix for this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98504. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart