In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Omit bus properties without a subordinate bus A bridge (a… (CVE-2026-98504)

The Linux kernel PCI subsystem had a latent vulnerability where the dynamic Open Firmware (OF) helpers of_pci_prop_bus_range() and of_pci_prop_intr_map() would dereference the subordinate bus pointer (pdev->subordinate) without verifying its presence. This occurs in PCI bridges (Type 1 header devices) that do not have a secondary bus allocated, for example, when no bus numbers are available or writable. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this leads to a NULL pointer dereference causing an early boot hang. The issue was introduced in kernel commit 1f340724419e (v6.15) and fixed by adding checks to generate 'bus-range' and 'interrupt-map' properties only when a subordinate bus exists, preserving the node and other properties for bridges without subordinate buses.

The vulnerability can cause a NULL pointer dereference in the Linux kernel during early boot, leading to a system hang or denial of service. This affects systems with PCI bridges lacking subordinate buses and with CONFIG_PCI_DYNAMIC_OF_NODES enabled. There is no indication of code execution or privilege escalation from this issue. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to prevent the NULL pointer dereference by checking for the presence of a subordinate bus before generating 'bus-range' and 'interrupt-map' properties. Users should update to a kernel version including this fix (introduced after v6.15). Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or changelogs for the exact fixed versions and apply the official updates accordingly.