PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for every config access. The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration: Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [] pci_generic_config_read+0x40/0xb0 [] pci_bus_read_config_dword+0x50/0xb0 [] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec [] pci_scan_single_device+0xa4/0x11c [] pci_scan_slot+0x9c/0x23c [] pci_scan_child_bus_extend+0x58/0x2f4 [] pci_scan_root_bus_bridge+0x64/0xe8 [] pci_host_probe+0x20/0xc8 [] pci_host_common_probe+0x144/0x1e4 Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.15.218, 6.1.185, 6.12.106, 6.18.47, 6.6.154, 7.1.11, 7.2.1
- CVEs
- CVE-2026-80917
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 17:32 UTC · Revision 1
Source evidence
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
core-osv · Original sourcePublished 9 Sept 2026, 16:13 UTC
In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for every config access. The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration: Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [] pci_generic_config_read+0x40/0xb0 [] pci_bus_read_config_dword+0x50/0xb0 [] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec [] pci_scan_single_device+0xa4/0x11c [] pci_scan_slot+0x9c/0x23c [] pci_scan_child_bus_extend+0x58/0x2f4 [] pci_scan_root_bus_bridge+0x64/0xe8 [] pci_host_probe+0x20/0xc8 [] pci_host_common_probe+0x144/0x1e4 Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_
osv:CVE-2026-80917
Kernel
Fixed versions: 5.15.218, 6.1.185, 6.6.154, 6.12.106, 6.18.47, 7.1.11, 7.2.1
Complete source record
{
"id": "bdb4b0fd14e8402d838d0b3c41f9db7b807b4ae63bd3f7c9fa66ca29df9d9754",
"url": "https://osv.dev/vulnerability/CVE-2026-80917",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems",
"summary": "In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for every config access. The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using \"pci-host-cam-generic\" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration: Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [] pci_generic_config_read+0x40/0xb0 [] pci_bus_read_config_dword+0x50/0xb0 [] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec [] pci_scan_single_device+0xa4/0x11c [] pci_scan_slot+0x9c/0x23c [] pci_scan_child_bus_extend+0x58/0x2f4 [] pci_scan_root_bus_bridge+0x64/0xe8 [] pci_host_probe+0x20/0xc8 [] pci_host_common_probe+0x144/0x1e4 Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_",
"evidence": "osv:CVE-2026-80917",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.15.218",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.185",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.154",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.106",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.47",
"evidence": "/affected/1/ranges"
},
{
"value": "7.1.11",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-80917",
"aliases": [
"CVE-2026-80917"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "8fe55ef23387ce3c7488375b1fd539420d7654bb"
},
{
"fixed": "5e52eb0290f66ba0732956dcb1e365b5ca3c5108"
},
{
"fixed": "baf9b0383ff770fdff123d3a832f3a99641d96dd"
},
{
"fixed": "8d08713ec83a18526d1ed1fd5f0d2b901d103a10"
},
{
"fixed": "74456843f18ba7f3045974d7e8b88ab993152b8c"
},
{
"fixed": "0c55707bd5d0d7670704cfd0dda933809b052f67"
},
{
"fixed": "a199293f3038db8d31d47aa60f1e18272cd82354"
},
{
"fixed": "0916948026f623844acd08888f7cbedbf1c48d6b"
},
{
"fixed": "008cb88edb41f3c7c8e0ed763ff9f26719830984"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.12.19"
},
{
"fixed": "5.13"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.13.4"
},
{
"fixed": "5.14"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "0b5877a1aeacdbf32b3bea91326592004ec7806f"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a037ebbe72a4f98495b193112e2b2000e5e09eb5"
}
]
}
],
"versions": [
"v5.12.19",
"v5.13.19",
"v5.13.18",
"v5.13.17",
"v5.13.16",
"v5.13.15",
"v5.13.14",
"v5.13.13",
"v5.13.12",
"v5.13.11",
"v5.13.10",
"v5.13.9",
"v5.13.8",
"v5.13.7",
"v5.13.6",
"v5.13.5",
"v5.13.4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80917.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.14.0"
},
{
"fixed": "5.15.218"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.185"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.154"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.106"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.47"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.1.11"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.2.0"
},
{
"fixed": "7.2.1"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80917.json"
}
}
],
"modified": "2026-10-28T02:30:21.587456394Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/008cb88edb41f3c7c8e0ed763ff9f26719830984",
"https://git.kernel.org/stable/c/0916948026f623844acd08888f7cbedbf1c48d6b",
"https://git.kernel.org/stable/c/0c55707bd5d0d7670704cfd0dda933809b052f67",
"https://git.kernel.org/stable/c/5e52eb0290f66ba0732956dcb1e365b5ca3c5108",
"https://git.kernel.org/stable/c/74456843f18ba7f3045974d7e8b88ab993152b8c",
"https://git.kernel.org/stable/c/8d08713ec83a18526d1ed1fd5f0d2b901d103a10",
"https://git.kernel.org/stable/c/a199293f3038db8d31d47aa60f1e18272cd82354",
"https://git.kernel.org/stable/c/baf9b0383ff770fdff123d3a832f3a99641d96dd",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80917.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-80917",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80917.json"
}
},
"related_cves": [
{
"value": "CVE-2026-80917",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 487840,
"published_at": "2026-09-09T16:13:15.202+00:00"
}