Cloudanix VulnDB

CVE-2026-80917

None

CVSS

—

EPSS

0.2%

Published

Sep 9, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Certain older 32-bit computers can crash while starting up because of a missing piece of code that handles their hardware configuration space.

Exploitation
Other
Attacker needs
None
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The pci-host-cam-generic driver omits the add_bus and remove_bus callbacks required by 32-bit ECAM mappings, so pci_ecam_map_bus receives a NULL base pointer and the first config-space read in pci_generic_config_read triggers a kernel NULL pointer dereference during bus enumeration.

Why it matters to the business

32-bit systems using the pci-host-cam-generic controller crash early in boot, producing denial of service and preventing the operating system from starting on affected hardware.

How an attack unfolds

An attacker who can force PCI host probe on a vulnerable 32-bit CAM platform (for example by loading a malicious DTB or triggering pci_host_common_probe) causes the kernel to dereference a NULL mapping during the first config read, resulting in an immediate Oops.

How to fix it

Apply a kernel update containing the fix that moves pci_generic_cam_ops (with add_bus/remove_bus) into ecam.c and exports it for use by pci-host-generic.c; rebuild and deploy the patched kernel on all 32-bit CAM targets.

How to confirm the fix worked

Confirm the running kernel contains the commit that defines and exports pci_generic_cam_ops; on 32-bit test hardware, verify that pci_host_probe completes without a NULL dereference during bus enumeration.

Typical attack path

  1. Load or present a device tree that selects pci-host-cam-generic on a 32-bit platform
  2. Kernel calls pci_host_probe which invokes pci_scan_root_bus_bridge
  3. pci_scan_slot triggers pci_bus_read_config_dword
  4. pci_generic_config_read dereferences the unset winp[] base and crashes

How to detect it

Inspect kernel logs and boot traces for the exact Oops sequence containing pci_generic_config_read and the NULL dereference at virtual address 00000800 during swapper or pci_host_probe.

  • Unable to handle kernel NULL pointer dereference at virtual address 00000800
  • pci_generic_config_read+0x40/0xb0
  • pci_host_common_probe+0x144/0x1e4

What your security team should do

  • Prioritize patching of 32-bit embedded or industrial kernels that use CAM-style PCI hosts
  • Add the supplied Oops strings to boot-time monitoring rules
  • Re-test device-tree-driven PCI enumeration after the update

The record

In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for every config access. The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration: Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [<c038db9c>] pci_generic_config_read+0x40/0xb0 [<c038da04>] pci_bus_read_config_dword+0x50/0xb0 [<c0391e94>] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec [<c039245c>] pci_scan_single_device+0xa4/0x11c [<c0392570>] pci_scan_slot+0x9c/0x23c [<c039388c>] pci_scan_child_bus_extend+0x58/0x2f4 [<c0393db0>] pci_scan_root_bus_bridge+0x64/0xe8 [<c0393e54>] pci_host_probe+0x20/0xc8 [<c03bc6f4>] pci_host_common_probe+0x144/0x1e4 Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c, move the CAM ops definition there as pci_generic_cam_ops (mirroring pci_generic_ecam_ops) and export it for pci-host-generic.c to reference. [mani: removed timestamp from log]

Affected packages

Ecosystem Package Introduced Fixed