CVE-2026-72487 - Vulnerability Details

- PCI: Check ROM header and data structure addr before accessing

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI: Check ROM header and data structure addr before accessing

We meet a crash when running stress-ng on x86_64 machine:

BUG: unable to handle page fault for address: ffa0000007f40000
RIP: 0010:pci_get_rom_size+0x52/0x220
Call Trace:
<TASK>
pci_map_rom+0x80/0x130
pci_read_rom+0x4b/0xe0
kernfs_file_read_iter+0x96/0x180
vfs_read+0x1b1/0x300

Our analysis reveals that the ROM space's start address is
0xffa0000007f30000, and size is 0x10000. Because of broken ROM space,
before calling readl(pds), the pds's value is 0xffa0000007f3ffff, which is
already pointed to the ROM space end, invoking readl() would read 4 bytes
therefore cause an out-of-bounds access and trigger a crash. Fix this by
adding image header and data structure checking.

We also found another crash on arm64 machine:

Unable to handle kernel paging request at virtual address ffff8000dd1393ff
Mem abort info:
ESR = 0x0000000096000021
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x21: alignment fault

The call trace is the same with x86_64, but the crash reason is that the
data structure addr is not aligned with 4, and arm64 machine report
"alignment fault". Fix this by adding alignment checking.

[bhelgaas: shorten function names, wrap comments]

Published: 2026-08-15

Score: 7.7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel PCI subsystem lacks validation of the ROM header and data structure addresses before accessing them. A malformed or misaligned ROM causes the kernel to perform a readl operation on an invalid address, triggering a page fault and leading to a kernel crash. This is an out‑of‑bounds memory read and results in a denial of service by terminating the kernel or affecting overall stability.

Affected Systems

All Linux kernel versions that contain the unvalidated PCI ROM access code are affected. The issue manifests on both x86_64 and arm64 architectures; the crashes are triggered by generic PCI device access or stress‑ng tests. Any distribution shipping kernels without the patch is impacted, while newer releases that include the header and alignment checks are not.

Risk and Exploitability

The vulnerability is local; an attacker must interact with a PCI device that exposes a corrupted or misaligned ROM area. The likely attack vector is a privileged local attacker who can drive the kernel to read the ROM, which the description infers from the observed crashes during stress‑ng use. The CVSS score of 7.7 indicates high severity, the EPSS score is less than 1% reflecting a low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`47b975d234eac39f3a72e5496d5f6158d8b806d1`	affected	< cd5b242d5848369b9e957340a7e30adee7b6763d
`47b975d234eac39f3a72e5496d5f6158d8b806d1`	affected	< 4997873e3abbad47a9e1e4abd05f045f77a74f22
`47b975d234eac39f3a72e5496d5f6158d8b806d1`	affected	< 724042f8f98d2594b9d164549fd4292c6bd58120
`47b975d234eac39f3a72e5496d5f6158d8b806d1`	affected	< 1d495446ec7ace5b61da366ffb161ee8319dd9a2
`47b975d234eac39f3a72e5496d5f6158d8b806d1`	affected	< 721ad5b72448b5065ed309017ab563205f162404
`47b975d234eac39f3a72e5496d5f6158d8b806d1`	affected	< 538796b807fcfb81b2ce40cc97a614fd8588feb5

Linux

affected

Version	Status	Constraints
`4.5`	affected	—
`0`	unaffected	< 4.5
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[47b975d234eac39f3a72e5496d5f6158d8b806d1,cd5b242d5848369b9e957340a7e30adee7b6763d)`	affected	code_commit	—
`[4997873e3abbad47a9e1e4abd05f045f77a74f22,724042f8f98d2594b9d164549fd4292c6bd58120)`	affected	code_commit	—
`[724042f8f98d2594b9d164549fd4292c6bd58120,1d495446ec7ace5b61da366ffb161ee8319dd9a2)`	affected	code_commit	—
`[1d495446ec7ace5b61da366ffb161ee8319dd9a2,721ad5b72448b5065ed309017ab563205f162404)`	affected	code_commit	—
`[721ad5b72448b5065ed309017ab563205f162404,538796b807fcfb81b2ce40cc97a614fd8588feb5)`	affected	code_commit	—
`[538796b807fcfb81b2ce40cc97a614fd8588feb5,cd5b242d5848369b9e957340a7e30adee7b6763d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.5`	affected	semver	—
`[0,4.5)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a Linux kernel version that implements PCI ROM header and alignment validation.
Reinstall or update all kernel packages from trusted distribution repositories to ensure the patch is applied.
If an immediate kernel upgrade is not feasible, temporarily disable or restrict access to vendor firmware loading from affected PCI devices until the patch is applied.

Generated by OpenCVE AI on August 22, 2026 at 03:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0018.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1d495446ec7ace5b61da366ffb161ee8319dd9a2
https://git.kernel.org/stable/c/4997873e3abbad47a9e1e4abd05f045f77a74f22
https://git.kernel.org/stable/c/538796b807fcfb81b2ce40cc97a614fd8588feb5
https://git.kernel.org/stable/c/721ad5b72448b5065ed309017ab563205f162404
https://git.kernel.org/stable/c/724042f8f98d2594b9d164549fd4292c6bd58120
https://git.kernel.org/stable/c/cd5b242d5848369b9e957340a7e30adee7b6763d
https://lore.kernel.org/linux-cve-announce/2026081538-CVE-2026-72487-bb33@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72487
https://www.cve.org/CVERecord?id=CVE-2026-72487

History

Thu, 20 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026081538-CVE-2026-72487-bb33@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72487 https://www.cve.org/CVERecord?id=CVE-2026-72487
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 13:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-125

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}`

Sat, 15 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr before accessing We meet a crash when running stress-ng on x86_64 machine: BUG: unable to handle page fault for address: ffa0000007f40000 RIP: 0010:pci_get_rom_size+0x52/0x220 Call Trace: <TASK> pci_map_rom+0x80/0x130 pci_read_rom+0x4b/0xe0 kernfs_file_read_iter+0x96/0x180 vfs_read+0x1b1/0x300 Our analysis reveals that the ROM space's start address is 0xffa0000007f30000, and size is 0x10000. Because of broken ROM space, before calling readl(pds), the pds's value is 0xffa0000007f3ffff, which is already pointed to the ROM space end, invoking readl() would read 4 bytes therefore cause an out-of-bounds access and trigger a crash. Fix this by adding image header and data structure checking. We also found another crash on arm64 machine: Unable to handle kernel paging request at virtual address ffff8000dd1393ff Mem abort info: ESR = 0x0000000096000021 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault The call trace is the same with x86_64, but the crash reason is that the data structure addr is not aligned with 4, and arm64 machine report "alignment fault". Fix this by adding alignment checking. [bhelgaas: shorten function names, wrap comments]
Title		PCI: Check ROM header and data structure addr before accessing
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1d495446ec7ace5b61da366ffb161ee8319dd9a2 https://git.kernel.org/stable/c/4997873e3abbad47a9e1e4abd05f045f77a74f22 https://git.kernel.org/stable/c/538796b807fcfb81b2ce40cc97a614fd8588feb5 https://git.kernel.org/stable/c/721ad5b72448b5065ed309017ab563205f162404 https://git.kernel.org/stable/c/724042f8f98d2594b9d164549fd4292c6bd58120 https://git.kernel.org/stable/c/cd5b242d5848369b9e957340a7e30adee7b6763d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:57:23.490Z

Updated: 2026-08-17T05:44:48.915Z

Reserved: 2026-08-09T03:40:39.936Z

Link: CVE-2026-72487

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:22.973

Modified: 2026-08-17T06:19:16.913

Link: CVE-2026-72487

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72487 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T03:15:04Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object