CVE-2026-80917: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
In the Linux kernel, the following vulnerability has been resolved:
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
On 32-bit systems the config space is too large to ioremap in one go, so pciecamcreate() maps each bus segment separately and relies on the ->addbus callback (pciecamaddbus) to populate the per-bus mapping in cfg->winp[]. pciecammapbus() then uses that mapping as the base for every config access.
The generic ECAM ops (pcigenericecamops) already provide the ->addbus and ->removebus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration:
Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pcigenericconfigread+0x40/0xb0 ra : pcigenericconfigread+0x2c/0xb0 [<c038db9c>] pcigenericconfigread+0x40/0xb0 [<c038da04>] pcibusreadconfigdword+0x50/0xb0 [<c0391e94>] pcibusgenericreaddevvendorid+0x3c/0x1ec [<c039245c>] pciscansingledevice+0xa4/0x11c [<c0392570>] pciscanslot+0x9c/0x23c [<c039388c>] pciscanchildbusextend+0x58/0x2f4 [<c0393db0>] pciscanrootbusbridge+0x64/0xe8 [<c0393e54>] pcihostprobe+0x20/0xc8 [<c03bc6f4>] pcihostcommonprobe+0x144/0x1e4
Fix this by giving the CAM ops the same ->addbus/->removebus callbacks. Since pciecamaddbus() and pciecamremovebus() are static to ecam.c, move the CAM ops definition there as pcigenericcamops (mirroring pcigenericecamops) and export it for pci-host-generic.c to reference.
[mani: removed timestamp from log]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.9.7+ #43
Event History
Frequently Asked Questions
Which deployments are exposed to this failure?
The reported condition applies to 32-bit hosts using the "pci-host-cam-generic" legacy CAM host driver. It occurs when the configuration space cannot be mapped in a single ioremap operation and requires per-bus mappings.
What is the operational symptom of an affected system?
The first PCI configuration-space read can dereference a NULL base pointer during PCI bus enumeration, causing a kernel NULL-pointer-dereference crash. The supplied example shows this occurring from pci_generic_config_read during early enumeration.