CVE-2026-80917

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

On 32-bit systems the config space is too large to ioremap in one go, so

pci_ecam_create() maps each bus segment separately and relies on the

->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in

cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for

every config access.

The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus

and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c

do not. As a result, on a 32-bit host using "pci-host-cam-generic" the

per-bus mapping is never set up and the first config read dereferences a

NULL base, crashing during bus enumeration:

Unable to handle kernel NULL pointer dereference at virtual address 00000800

Oops [#1]

CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43

Hardware name: Digilent Nexys-Video-A7 RV32 (DT)

epc : pci_generic_conf

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References