CVE-2026-98504: PCI: of_property: Omit bus properties without a subordinate bus
In the Linux kernel, the following vulnerability has been resolved:
PCI: ofproperty: Omit bus properties without a subordinate bus
A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.g., if there are no available bus numbers or the bridge secondary/subordinate bus numbers are not writable.
The dynamic OF helpers ofpcipropbusrange() and ofpcipropintrmap() dereference pdev->subordinate without checking it. When CONFIGPCIDYNAMICOFNODES is enabled, this can cause a NULL pointer dereference and early boot hang.
Generate 'bus-range' and 'interrupt-map' properties only when a subordinate bus exists. Keep the node and its remaining properties for bridges without one.
The problem was latent since 407d1a51921e ("PCI: Create device tree node for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create device tree PCI host bridge node"), which appeared in v6.15. Before 1f340724419e, ofpcimakedevnode() returned early because the parent OF node was missing.
[bhelgaas: move pdev->subordinate test to callees, commit log]
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this early-boot failure?
Systems running a Linux kernel where the PCI host bridge device-tree node creation change from v6.15 is present and CONFIG_PCI_DYNAMIC_OF_NODES is enabled are exposed. The failure additionally requires a PCI bridge with a Type 1 header that has no allocated subordinate bus.
What conditions can leave a PCI bridge without a subordinate bus?
This can occur when no bus numbers are available, or when the bridge secondary and subordinate bus numbers cannot be written. Under the affected configuration, dynamic OF property generation can then dereference the missing subordinate-bus pointer.
How can I determine whether a system is affected or has encountered the issue?
Check whether the kernel is built with CONFIG_PCI_DYNAMIC_OF_NODES and includes the PCI host bridge device-tree node creation change introduced in v6.15. Affected systems may experience a NULL pointer dereference and hang during early boot when enumerating a bridge without a subordinate bus.
What does the fix change for bridges that have no subordinate bus?
The fix skips generation of the bus-range and interrupt-map properties when no subordinate bus exists. It retains the bridge device-tree node and its other properties.