CVE-2026-80651: crypto: ccp/sev-dev-tsm - bail out early when pdev->bus is NULL
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp/sev-dev-tsm - bail out early when pdev->bus is NULL
dsmcreate() initially checks pdev->bus when computing segmentid:
u8 segmentid = pdev->bus ? pcidomainnr(pdev->bus) : 0;
But the next two lines unconditionally dereference pdev->bus via pciefindrootport() and especially pcidevid(pdev), which expands to PCIDEVID(dev->bus->number, dev->devfn). If pdev->bus is in fact NULL, segmentid is initialised to 0 but the very next statement crashes the kernel.
smatch flags this:
drivers/crypto/ccp/sev-dev-tsm.c:253 dsmcreate() error: we previously assumed 'pdev->bus' could be null (see line 251)
Make the NULL handling consistent: if pdev->bus is NULL the device has no PCI context to work with and SEV TIO setup cannot proceed, so return -ENODEV before any of the bus-dependent lookups. The remaining initialisation now runs only on the path where pdev->bus is known to be valid.
No change for callers where pdev->bus is non-NULL, which is the only case where dsmcreate() did meaningful work before this change.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel crypto: ccp/sev-dev-tsmto a version that resolves this vulnerability.Patch crypto: ccp/sev-dev-tsm - bail out early when pdev->bus is NULL - Configuration
In dsm_create(), add consistent NULL handling: if pdev->bus is NULL, bail out early by returning -ENODEV before calling any bus-dependent functions (e.g., pci_domain_nr(pdev->bus), pcie_find_root_port(), or pci_dev_id(pdev)) and only initialise segment_id for the NULL case (segment_id initialised to 0).
drivers/crypto/ccp/sev-dev-tsm.c (dsm_create) pdev->bus NULL handling = return -ENODEV before any bus-dependent lookups - Compensating control
Ensure callers handle a possible -ENODEV return from dsm_create() when pdev->bus is NULL (SEV TIO setup cannot proceed without PCI context).
Event History
Frequently Asked Questions
What systems are exposed to the crash condition?
The condition is limited to SEV TIO setup in the Linux kernel when dsm_create() is called for a device whose pdev->bus pointer is NULL. Devices with a valid PCI bus are not affected by this specific NULL dereference.
What is required to trigger the issue?
The affected path must attempt SEV TIO setup for a device without PCI context. Before the fix, subsequent PCI root-port and device-ID lookups dereference the NULL bus pointer and can crash the kernel.
What happens after applying the fix?
The kernel returns -ENODEV before performing bus-dependent operations when pdev->bus is NULL. SEV TIO setup does not proceed for devices lacking PCI context, while behavior for devices with a non-NULL bus is unchanged.