Executive brief
The Linux kernel's PCI host controller driver for generic 32-bit CAM (Configuration Access Mechanism) systems crashes during bus enumeration due to a NULL pointer dereference. This prevents systems from detecting and initializing PCI devices, resulting in boot failures or incomplete hardware detection on affected 32-bit platforms.
Technical details
The vulnerability is a NULL pointer dereference in the pci-host-generic driver when handling PCI configuration space access on 32-bit systems using legacy CAM mode. On 32-bit systems, the config space is too large to map in a single ioremap operation, so the kernel must map each bus segment individually. The generic ECAM ops provide ->add_bus callbacks to populate the per-bus mapping, but the CAM ops in pci-host-generic.c were missing these callbacks. This causes pci_ecam_map_bus() to dereference a NULL base pointer when attempting the first config read during bus enumeration. The fix moves the CAM ops definition into ecam.c as pci_generic_cam_ops (mirroring pci_generic_ecam_ops) and exports it with proper ->add_bus/->remove_bus callbacks.
Affected products
- Linux Linux kernel 6.9.7 and earlier versions with pci-host-generic driver
Timeline
- 2026-09-09: disclosed