Executive brief
The Linux kernel's SEV-TIO (Secure Encrypted Virtualization Trusted I/O) driver could crash due to a null pointer dereference when initializing PCIe device management. In systems where a PCI device lacks a valid bus context, the driver would attempt to access memory through a null pointer, causing a kernel panic and disrupting system availability.
Technical details
This is a null pointer dereference vulnerability in the dsm_create() function within drivers/crypto/ccp/sev-dev-tsm.c. The code initially checks if pdev->bus is null when computing segment_id but then unconditionally dereferences pdev->bus in subsequent calls to pcie_find_root_port() and pci_dev_id() without re-validating the pointer. An attacker with the ability to trigger SEV-TIO initialization on a device with a null bus pointer can cause a kernel crash. The fix adds an early return with -ENODEV if pdev->bus is null, ensuring no subsequent dereferencing occurs on that path. This is a local denial-of-service issue requiring system-level access to trigger.
Affected products
- Linux Linux kernel 5.4 and later (prior to fix in commit 930d9d36ea618a775985446a125aedeb401db522)
Timeline
- 2026-08-28: disclosed: CVE-2026-80651 published
- 2026-05-15: patched: Upstream fix merged (commit 930d9d36ea618a775985446a125aedeb401db522)