Linux Kernel up to 7.1.4 ccp/sev-dev-tsm sev-dev-tsm.c dsm_create bus null pointer dereference

Summaryinfo

A vulnerability classified as critical has been found in Linux Kernel up to 7.1.4. This affects the function dsm_create of the file drivers/crypto/ccp/sev-dev-tsm.c of the component ccp/sev-dev-tsm. Performing a manipulation of the argument bus results in null pointer dereference. This vulnerability is identified as CVE-2026-80651. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.4. It has been classified as critical. This affects the function dsm_create of the file drivers/crypto/ccp/sev-dev-tsm.c of the component ccp/sev-dev-tsm. The manipulation of the argument bus with an unknown input leads to a null pointer dereference vulnerability. CWE is classifying the issue as CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev->bus is NULL dsm_create() initially checks pdev->bus when computing segment_id: u8 segment_id = pdev->bus ? pci_domain_nr(pdev->bus) : 0; But the next two lines unconditionally dereference pdev->bus via pcie_find_root_port() and especially pci_dev_id(pdev), which expands to PCI_DEVID(dev->bus->number, dev->devfn). If pdev->bus is in fact NULL, segment_id is initialised to 0 but the very next statement crashes the kernel. smatch flags this: drivers/crypto/ccp/sev-dev-tsm.c:253 dsm_create() error: we previously assumed 'pdev->bus' could be null (see line 251) Make the NULL handling consistent: if pdev->bus is NULL the device has no PCI context to work with and SEV TIO setup cannot proceed, so return -ENODEV before any of the bus-dependent lookups. The remaining initialisation now runs only on the path where pdev->bus is known to be valid. No change for callers where pdev->bus is non-NULL, which is the only case where dsm_create() did meaningful work before this change.

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-80651 since 08/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/28/2026).

Upgrading to version 7.1.5 eliminates this vulnerability. Applying the patch 6bafd740095fb3d0e9a00540bc8f3484c38e6f85/930d9d36ea618a775985446a125aedeb401db522 is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion