CVE-2026-98504 - Vulnerability Details

- PCI: of_property: Omit bus properties without a subordinate bus

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI: of_property: Omit bus properties without a subordinate bus

A bridge (a device with a Type 1 header) may not have a secondary bus
allocated (pdev->subordinate), e.g., if there are no available bus numbers
or the bridge secondary/subordinate bus numbers are not writable.

The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map()
dereference pdev->subordinate without checking it. When
CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer
dereference and early boot hang.

Generate 'bus-range' and 'interrupt-map' properties only when a subordinate
bus exists. Keep the node and its remaining properties for bridges without
one.

The problem was latent since 407d1a51921e ("PCI: Create device tree node
for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create
device tree PCI host bridge node"), which appeared in v6.15. Before
1f340724419e, of_pci_make_dev_node() returned early because the parent OF
node was missing.

[bhelgaas: move pdev->subordinate test to callees, commit log]

Published: 2026-10-18

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the functions that build device tree properties for PCI bridges dereference a NULL pointer when a bridge has no subordinate bus. This results in an early boot hang, effectively stopping the system from starting normally. The weakness is a classic NULL pointer dereference, categorized as CWE‑476.

Affected Systems

All users of the Linux kernel where CONFIG_PCI_DYNAMIC_OF_NODES is enabled and device tree nodes are created for PCI bridges. The issue applies to kernel versions prior to the patch that generated bus-range and interrupt-map properties only when a subordinate bus exists, notably before kernel v6.15.

Risk and Exploitability

The EPSS score is < 1% and the vulnerability is not listed in CISA's KEV catalog. The problem can be triggered only during system initialization when dynamic OF nodes are enabled and a bridge without a subordinate bus is present. The likely attack vector is local or firmware‑level; an adversary who can influence the device tree or kernel configuration during boot could force the system into a deadlock. The CVSS score of 4.1 reflects moderate overall risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`407d1a51921e9f28c1bcec647c2205925bd1fdab`	affected	< ccd32fa3489cbe86a0b281da4447b4c7eadb3518
`407d1a51921e9f28c1bcec647c2205925bd1fdab`	affected	< a6d97d10e49ae49026ae13af6c41634fce470a37
`407d1a51921e9f28c1bcec647c2205925bd1fdab`	affected	< 879c911f77b8a7862aa16079b04efc3fdc5d32ec
`407d1a51921e9f28c1bcec647c2205925bd1fdab`	affected	< aee774588abd78f75952fd34c3fa461bc46b62c2
`407d1a51921e9f28c1bcec647c2205925bd1fdab`	affected	< 8805840aad73df7146778be243a196d48b4f6430

Linux

affected

Version	Status	Constraints
`6.6`	affected	—
`0`	unaffected	< 6.6
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[407d1a51921e9f28c1bcec647c2205925bd1fdab,ccd32fa3489cbe86a0b281da4447b4c7eadb3518)`	affected	code_commit	—
`[407d1a51921e9f28c1bcec647c2205925bd1fdab,a6d97d10e49ae49026ae13af6c41634fce470a37)`	affected	code_commit	—
`[407d1a51921e9f28c1bcec647c2205925bd1fdab,879c911f77b8a7862aa16079b04efc3fdc5d32ec)`	affected	code_commit	—
`[407d1a51921e9f28c1bcec647c2205925bd1fdab,aee774588abd78f75952fd34c3fa461bc46b62c2)`	affected	code_commit	—
`[407d1a51921e9f28c1bcec647c2205925bd1fdab,8805840aad73df7146778be243a196d48b4f6430)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.6`	affected	semver	—
`[0,6.6)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to version 6.15 or later, which includes a fix that checks for subordinate buses before allocating device tree properties.
If dynamic OF nodes are required, review the kernel configuration to ensure that CONFIG_PCI_DYNAMIC_OF_NODES is enabled only on platforms where it has been tested and validated; consider disabling it on systems that do not need the feature.
After updating, reboot the system and verify that PCI bridges without subordinate buses no longer cause a boot hang; monitor system logs for any unexpected failures.

Generated by OpenCVE AI on October 20, 2026 at 12:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00206.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98504.mbox
https://git.kernel.org/stable/c/879c911f77b8a7862aa16079b04efc3fdc5d32ec
https://git.kernel.org/stable/c/8805840aad73df7146778be243a196d48b4f6430
https://git.kernel.org/stable/c/a6d97d10e49ae49026ae13af6c41634fce470a37
https://git.kernel.org/stable/c/aee774588abd78f75952fd34c3fa461bc46b62c2
https://git.kernel.org/stable/c/ccd32fa3489cbe86a0b281da4447b4c7eadb3518
https://nvd.nist.gov/vuln/detail/CVE-2026-98504
https://www.cve.org/CVERecord?id=CVE-2026-98504

History

Tue, 20 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98504.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98504 https://www.cve.org/CVERecord?id=CVE-2026-98504
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Omit bus properties without a subordinate bus A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.g., if there are no available bus numbers or the bridge secondary/subordinate bus numbers are not writable. The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference pdev->subordinate without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer dereference and early boot hang. Generate 'bus-range' and 'interrupt-map' properties only when a subordinate bus exists. Keep the node and its remaining properties for bridges without one. The problem was latent since 407d1a51921e ("PCI: Create device tree node for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create device tree PCI host bridge node"), which appeared in v6.15. Before 1f340724419e, of_pci_make_dev_node() returned early because the parent OF node was missing. [bhelgaas: move pdev->subordinate test to callees, commit log]
Title		PCI: of_property: Omit bus properties without a subordinate bus
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/879c911f77b8a7862aa16079b04efc3fdc5d32ec https://git.kernel.org/stable/c/8805840aad73df7146778be243a196d48b4f6430 https://git.kernel.org/stable/c/a6d97d10e49ae49026ae13af6c41634fce470a37 https://git.kernel.org/stable/c/aee774588abd78f75952fd34c3fa461bc46b62c2 https://git.kernel.org/stable/c/ccd32fa3489cbe86a0b281da4447b4c7eadb3518

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:17:05.274Z

Updated: 2026-10-19T09:20:43.250Z

Reserved: 2026-09-25T10:25:14.353Z

Link: CVE-2026-98504

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:01.493

Modified: 2026-10-19T10:19:03.637

Link: CVE-2026-98504

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98504 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T12:30:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object