CVE-2026-80917 Overview
CVE-2026-80917 is a NULL pointer dereference vulnerability in the Linux kernel's PCI host-generic driver. The flaw affects 32-bit systems using the legacy CAM (Configuration Access Mechanism) operations exposed through pci-host-cam-generic. On these systems, the config space is too large to ioremap in one operation, so pci_ecam_create() maps each bus segment separately. The legacy CAM ops did not implement the ->add_bus and ->remove_bus callbacks, leaving cfg->winp[] unpopulated. The first config read then dereferences a NULL base pointer during bus enumeration, producing a kernel oops.
Critical Impact
A 32-bit Linux host booting with the pci-host-cam-generic compatible string crashes during PCI bus enumeration, preventing the system from completing initialization.
Affected Products
- Linux kernel builds using the pci-host-generic driver on 32-bit architectures
- Systems configured with the legacy pci-host-cam-generic compatible node
- 32-bit RISC-V, ARM, and similar platforms exercising legacy CAM PCI hosts
Discovery Timeline
- 2026-09-09 - CVE-2026-80917 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-80917
Vulnerability Analysis
The defect exists in the PCI generic host driver's handling of legacy CAM configuration access on 32-bit systems. The generic ECAM (Enhanced Configuration Access Mechanism) operations struct pci_generic_ecam_ops provides ->add_bus and ->remove_bus callbacks that invoke pci_ecam_add_bus(). This callback populates the per-bus mapping stored in cfg->winp[]. The legacy CAM ops in pci-host-generic.c omitted these callbacks entirely.
On a 32-bit host, config space cannot be mapped in a single ioremap call because the virtual address space is constrained. The kernel therefore relies on the per-bus mapping populated by ->add_bus. Without that mapping, pci_ecam_map_bus() returns a NULL base. The subsequent read in pci_generic_config_read() dereferences the NULL pointer and triggers the oops shown in the reported stack trace at pci_generic_config_read+0x40/0xb0.
Root Cause
The root cause is a missing callback registration [CWE-476]. pci_generic_cam_ops did not register ->add_bus and ->remove_bus, so per-bus config windows were never mapped on 32-bit hosts. The fix moves the CAM ops definition into ecam.c, wires up pci_ecam_add_bus() and pci_ecam_remove_bus(), and exports the ops structure for pci-host-generic.c.
Attack Vector
The issue is a boot-time kernel crash, not a remotely exploitable flaw. Impact is limited to denial of service through failure to complete PCI enumeration. Triggering requires a 32-bit kernel configured with the pci-host-cam-generic device tree binding. No user interaction or network access is involved.
The vulnerability manifests during early PCI probe. Refer to the upstream commits linked in the references for exact source-level changes.
Detection Methods for CVE-2026-80917
Indicators of Compromise
- Kernel oops messages referencing pci_generic_config_read+0x40/0xb0 in the call trace
- Unable to handle kernel NULL pointer dereference at virtual address 00000800 logged during boot
- PCI enumeration failing on 32-bit hosts that declare a pci-host-cam-generic node in device tree
Detection Strategies
- Inventory 32-bit Linux devices that reference the pci-host-cam-generic compatible string in their device tree source or FDT blobs.
- Compare running kernel versions against the fixed commits published on git.kernel.org for each stable branch.
- Parse boot logs and serial console captures for the NULL pointer dereference signature during PCI probe.
Monitoring Recommendations
- Aggregate kernel panic and oops events from embedded and edge fleets into a central log store for pattern analysis.
- Alert on boot failures on 32-bit ARM and RISC-V platforms after kernel upgrades.
- Track downstream vendor kernels for backport status of the referenced upstream commits.
How to Mitigate CVE-2026-80917
Immediate Actions Required
- Apply the upstream Linux kernel patch that adds ->add_bus and ->remove_bus callbacks to pci_generic_cam_ops.
- Rebuild and redeploy 32-bit kernels used with legacy CAM PCI hosts before enabling PCI in production images.
- Validate PCI enumeration completes successfully during boot after patching.
Patch Information
The fix is available across multiple stable branches. Relevant upstream commits include 008cb88, 0916948, 0c55707b, 5e52eb02, 74456843, 8d08713e, a199293f, and baf9b038. Apply the commit matching your stable branch.
Workarounds
- Boot without a pci-host-cam-generic device tree node if PCI is not required on the affected 32-bit platform.
- Switch the device tree binding to pci-host-ecam-generic where hardware supports ECAM, since the ECAM ops already register the required callbacks.
- Disable CONFIG_PCI_HOST_GENERIC in the kernel configuration on affected 32-bit builds until the patch can be applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
