Description
In the Linux kernel, the following vulnerability has been resolved:

PCI: of_property: Omit bus properties without a subordinate bus

A bridge (a device with a Type 1 header) may not have a secondary bus
allocated (pdev->subordinate), e.g., if there are no available bus numbers
or the bridge secondary/subordinate bus numbers are not writable.

The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map()
dereference pdev->subordinate without checking it. When
CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer
dereference and early boot hang.

Generate 'bus-range' and 'interrupt-map' properties only when a subordinate
bus exists. Keep the node and its remaining properties for bridges without
one.

The problem was latent since 407d1a51921e ("PCI: Create device tree node
for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create
device tree PCI host bridge node"), which appeared in v6.15. Before
1f340724419e, of_pci_make_dev_node() returned early because the parent OF
node was missing.

[bhelgaas: move pdev->subordinate test to callees, commit log]
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service (boot hang)
Action: Patch Immediately
AI Analysis

Impact

In the Linux kernel, when a PCI bridge device lacks a subordinate bus, the functions that build device tree properties dereference a NULL pointer. This results in an early boot hang, effectively preventing the system from starting normally. The weakness is a classic NULL pointer dereference that can lead to a complete denial of service for the affected machine.

Affected Systems

All users of the Linux kernel where CONFIG_PCI_DYNAMIC_OF_NODES is enabled and device tree nodes are created for PCI bridges. The issue applies to kernel versions prior to the patch that generated bus-range and interrupt-map properties only when a subordinate bus exists, notably before kernel v6.15.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. The problem can be triggered only during system initialization when dynamic OF nodes are enabled and a bridge without a subordinate bus is present. The likely attack vector is local or firmware‑level; an adversary who can influence the device tree or kernel configuration during boot could force the system into a deadlock. Although no CVSS value is supplied, the impact of a boot hang implies a high severity and a high likelihood of exploitation in environments that meet the conditions.

Generated by OpenCVE AI on October 18, 2026 at 16:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to version 6.15 or later, which includes a fix that checks for subordinate buses before allocating device tree properties.
  • If dynamic OF nodes are required, review the kernel configuration to ensure that CONFIG_PCI_DYNAMIC_OF_NODES is enabled only on platforms where it has been tested and validated; consider disabling it on systems that do not need the feature.
  • After updating, reboot the system and verify that PCI bridges without subordinate buses no longer cause a boot hang; monitor system logs for any unexpected failures.

Generated by OpenCVE AI on October 18, 2026 at 16:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Omit bus properties without a subordinate bus A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.g., if there are no available bus numbers or the bridge secondary/subordinate bus numbers are not writable. The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference pdev->subordinate without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer dereference and early boot hang. Generate 'bus-range' and 'interrupt-map' properties only when a subordinate bus exists. Keep the node and its remaining properties for bridges without one. The problem was latent since 407d1a51921e ("PCI: Create device tree node for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create device tree PCI host bridge node"), which appeared in v6.15. Before 1f340724419e, of_pci_make_dev_node() returned early because the parent OF node was missing. [bhelgaas: move pdev->subordinate test to callees, commit log]
Title PCI: of_property: Omit bus properties without a subordinate bus
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:17:05.274Z

Reserved: 2026-09-25T10:25:14.353Z

Link: CVE-2026-98504

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:01.493

Modified: 2026-10-18T16:17:01.493

Link: CVE-2026-98504

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T17:00:09Z

Weaknesses