CVE-2026-80917 in Linux
Summary
by MITRE • 09/09/2026
In the Linux kernel, the following vulnerability has been resolved:
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for
every config access.
The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration:
Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1]
CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [<c038db9c>] pci_generic_config_read+0x40/0xb0
[<c038da04>] pci_bus_read_config_dword+0x50/0xb0
[<c0391e94>] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec
[<c039245c>] pci_scan_single_device+0xa4/0x11c
[<c0392570>] pci_scan_slot+0x9c/0x23c
[<c039388c>] pci_scan_child_bus_extend+0x58/0x2f4
[<c0393db0>] pci_scan_root_bus_bridge+0x64/0xe8
[<c0393e54>] pci_host_probe+0x20/0xc8
[<c03bc6f4>] pci_host_common_probe+0x144/0x1e4
Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c, move the CAM ops definition there as pci_generic_cam_ops (mirroring pci_generic_ecam_ops) and export it for pci-host-generic.c to reference.
[mani: removed timestamp from log]
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The Linux kernel contains a critical vulnerability within the PCI subsystem specifically affecting 32-bit systems utilizing the generic CAM controller architecture. This flaw manifests as a NULL pointer dereference that occurs during bus enumeration, leading to an immediate system crash or kernel panic. The root cause lies in the incomplete implementation of callback functions for the legacy Configuration Access Mechanism (CAM) operations compared to their Enhanced Configuration Access Mechanism (ECAM) counterparts. On 32-bit architectures, the PCI configuration space is too large to be mapped into memory using a single ioremap operation. Consequently, the kernel must map each bus segment separately and relies on specific callbacks to populate per-bus mappings in the window pointer array. While the generic ECAM operations correctly implement these necessary add_bus and remove_bus callbacks, the CAM operations defined in pci-host-generic.c fail to provide them.
This omission results in a scenario where the per-bus mapping is never established for devices enumerated on 32-bit hosts using the pci-host-cam-generic driver. When the kernel attempts to perform its first configuration read during bus scanning, it utilizes an uninitialized or NULL base address stored in the window pointer array. This leads directly to a fatal exception when the processor attempts to access memory at virtual address zero plus an offset, effectively crashing the system before any devices can be successfully initialized. The technical flaw is classified under CWE-476, which denotes a NULL Pointer Dereference vulnerability, as the code fails to check for or initialize necessary pointers before use.
The operational impact of this vulnerability is severe for systems relying on 32-bit PCI host controllers with legacy CAM support. It prevents successful booting and device initialization, rendering the system unusable until the issue is resolved. The crash occurs early in the hardware probing phase, specifically within pci_generic_config_read when invoked by pci_bus_read_config_dword during the scanning of single devices and slots. This disrupts the entire PCI enumeration process, preventing the operating system from recognizing or configuring any downstream PCIe devices attached to that host bridge.
The resolution involves aligning the CAM operations with the established ECAM pattern by implementing the missing add_bus and remove_bus callbacks. Since these helper functions are static within ecam.c, they cannot be directly referenced by pci-host-generic.c without violating encapsulation principles. Therefore, the fix moves the definition of the generic CAM operations to ecam.c as a new structure named pci_generic_cam_ops, mirroring the existing pci_generic_ecam_ops structure. This structure is then exported for use by pci-host-generic.c, ensuring that every bus segment is properly mapped before any configuration accesses are attempted. From an adversarial perspective, while this vulnerability primarily causes denial of service through system instability rather than direct exploitation for privilege escalation or data theft, it aligns with ATT&CK technique T1499 Endpoint Denial of Service if triggered intentionally in a vulnerable environment. Mitigation requires applying the kernel patch that exports and utilizes these callbacks to ensure proper memory mapping initialization during PCI host probe operations.