Cloudanix VulnDB

CVE-2026-98504

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can stop some computers from starting up when certain hardware connections are present and a specific low-level setting is turned on.

Exploitation
Other
Attacker needs
None
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in Linux kernel PCI dynamic OF node helpers (of_pci_prop_bus_range, of_pci_prop_intr_map) when a Type-1 bridge lacks a subordinate bus (pdev->subordinate NULL) under CONFIG_PCI_DYNAMIC_OF_NODES, resulting in early boot hang.

Why it matters to the business

Systems may fail to boot or experience kernel panic during early initialization on configurations with PCI bridges that have no secondary bus allocated, disrupting availability of servers and embedded devices that enable the affected kernel option.

How an attack unfolds

An attacker with the ability to influence PCI topology or kernel configuration triggers the dereference during device-tree population at boot; the latent bug became reachable after v6.15 changes that create host-bridge OF nodes without ensuring subordinate buses exist.

How to fix it

Upgrade to a kernel containing the fix that adds subordinate-bus checks before generating 'bus-range' and 'interrupt-map' properties; rebuild with the corrected PCI OF code and redeploy.

How to confirm the fix worked

Confirm the patched kernel source contains the subordinate-bus test in the OF property helpers; boot test systems with CONFIG_PCI_DYNAMIC_OF_NODES enabled on bridge configurations that previously lacked subordinate buses and verify successful boot without panic.

Typical attack path

  1. Enable CONFIG_PCI_DYNAMIC_OF_NODES in kernel build
  2. Boot on hardware or virtual platform where a PCI bridge has no allocated subordinate bus
  3. Kernel reaches of_pci_make_dev_node and calls helpers that dereference pdev->subordinate without a check
  4. NULL dereference causes kernel panic or hang before userspace starts

How to detect it

Review early kernel logs and dmesg for NULL pointer dereference traces referencing of_pci_prop_bus_range or of_pci_prop_intr_map; monitor boot failures on systems with the dynamic-OF config enabled.

What your security team should do

  • Identify all kernels built with CONFIG_PCI_DYNAMIC_OF_NODES and schedule immediate upgrade to a fixed version
  • Prioritize patching of production boot images and embedded devices within the next maintenance window
  • Add kernel boot-failure monitoring for PCI-related panics to detect exposure during rollout

The record

In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Omit bus properties without a subordinate bus A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.g., if there are no available bus numbers or the bridge secondary/subordinate bus numbers are not writable. The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference pdev->subordinate without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer dereference and early boot hang. Generate 'bus-range' and 'interrupt-map' properties only when a subordinate bus exists. Keep the node and its remaining properties for bridges without one. The problem was latent since 407d1a51921e ("PCI: Create device tree node for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create device tree PCI host bridge node"), which appeared in v6.15. Before 1f340724419e, of_pci_make_dev_node() returned early because the parent OF node was missing. [bhelgaas: move pdev->subordinate test to callees, commit log]

Affected packages

Ecosystem Package Introduced Fixed