Executive brief
The Linux kernel's PCI DesignWare controller debugfs cleanup routine can crash when a PCI controller lacks RAS DES (Resilience and Error Signaling - Designated Event Sequencer) capability. During system shutdown or module unload, a NULL pointer dereference occurs because the code attempts to clean up uninitialized debug structures. This causes a kernel panic, disrupting normal shutdown sequences and potentially impacting system stability.
Technical details
The vulnerability is a NULL pointer dereference in the dwc_pcie_rasdes_debugfs_deinit() function within the PCI DesignWare controller driver. The root cause is that dwc_pcie_rasdes_debugfs_init() returns success even when the controller has no RAS DES capability, leaving pci->debugfs->rasdes_info unset. Later, the common debugfs teardown path unconditionally calls dwc_pcie_rasdes_debugfs_deinit(), which immediately dereferences rasdes_info without checking for NULL, resulting in a kernel crash. The fix adds an early return in the deinit function to check whether rasdes_info is NULL before attempting cleanup. No special privileges or network access are required; the crash occurs during normal kernel shutdown operations on affected PCI controllers.
Affected products
- Linux Linux kernel 5.15 and later (up to approximately 6.9)
Timeline
- 2026-08-28: disclosed
- 2026-06-11: patched: Upstream fix merged; backport commits follow
- 2026-05-18: other: Original vulnerability report/fix authored