CVE-2026-98504 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
PCI: of_property: Omit bus properties without a subordinate bus
A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.g., if there are no available bus numbers or the bridge secondary/subordinate bus numbers are not writable.
The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference pdev->subordinate without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer dereference and early boot hang.
Generate 'bus-range' and 'interrupt-map' properties only when a subordinate bus exists. Keep the node and its remaining properties for bridges without one.
The problem was latent since 407d1a51921e ("PCI: Create device tree node for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create device tree PCI host bridge node"), which appeared in v6.15. Before 1f340724419e, of_pci_make_dev_node() returned early because the parent OF node was missing.
[bhelgaas: move pdev->subordinate test to callees, commit log]
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel contains a critical vulnerability within its PCI device tree property handling subsystem that can lead to system instability during the boot process. This issue specifically affects systems where PCI bridges are initialized but do not have an allocated subordinate bus number assigned to them. A PCI bridge, identified by having a Type 1 configuration space header, is expected to manage downstream buses. However, in certain hardware configurations or due to resource constraints such as exhausted available bus numbers, the kernel may fail to allocate a secondary or subordinate bus for these bridges. When this occurs, the internal data structure representing the device's subordinate bus remains null. The vulnerability arises because specific dynamic Open Firmware property helper functions, namely of_pci_prop_bus_range and of_pci_prop_intr_map, attempt to dereference the pointer to this subordinate bus without performing an existence check. This lack of defensive programming creates a direct path for memory corruption or system crashes when the code assumes the presence of valid data that does not exist in these edge cases.
The operational impact of this vulnerability is severe, manifesting as a NULL pointer dereference that typically results in an early boot hang. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, which allows the kernel to dynamically generate device tree nodes for PCI devices based on hardware configuration, the system attempts to process properties related to bus ranges and interrupt mappings. If the bridge lacks a subordinate bus, these functions access invalid memory addresses. This leads to a kernel panic or immediate halt of the boot sequence, preventing the operating system from initializing properly. The issue is particularly insidious because it remained latent for several kernel versions since its introduction in commit 407d1a51921e, which created device tree nodes for bridges. It only became reachable and exploitable with the changes introduced in version 6.15 via commit 1f340724419e, which modified how PCI host bridge nodes are created. Prior to this change, earlier code paths would return early if parent OF nodes were missing, inadvertently masking the bug until the new logic exposed it by proceeding further into property generation regardless of subordinate bus availability.
From a technical classification perspective, this vulnerability aligns with CWE-476, which describes a NULL Pointer Dereference. The root cause is a failure to validate pointer validity before use, violating fundamental principles of safe memory access in systems programming. In the context of the MITRE ATT&CK framework for Linux, this can be categorized under techniques related to system discovery or initial exploitation vectors that rely on kernel-level errors to disrupt availability. While not directly exploitable by an external attacker for remote code execution in most standard scenarios due to its occurrence during boot, it represents a significant reliability flaw that compromises the Availability component of the CIA triad. The vulnerability highlights the risks associated with dynamic resource allocation and device tree generation where assumptions about hardware topology may not hold true across all supported platforms.
To mitigate this issue, developers must ensure that any code accessing PCI subordinate bus structures performs explicit null checks before dereferencing them. In the context of the Linux kernel fix described, the solution involves modifying the helper functions to generate 'bus-range' and 'interrupt-map' properties only when a valid subordinate bus exists. For bridges without an allocated subordinate bus, the system should retain the device node but skip the generation of these specific properties that depend on downstream bus information. This approach maintains compatibility with existing device tree structures while preventing illegal memory access. System administrators relying on affected kernel versions must apply patches or update to newer releases where this logic has been corrected. Furthermore, rigorous testing of PCI enumeration paths under conditions of limited bus number availability is recommended to ensure robustness against similar latent defects in other subsystems that interact with hardware topology data.