Look up another CVE · open CVE-2026-72487 in the interactive tracker
CVE-2026-72487
PCI: Check ROM header and data structure addr before accessing
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/pci. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72487 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
We meet a crash when running stress-ng on x86_64 machine: BUG: unable to handle page fault for address: ffa0000007f40000 RIP: 0010:pci_get_rom_size+0x52/0x220 Call Trace: <TASK> pci_map_rom+0x80/0x130 pci_read_rom+0x4b/0xe0 kernfs_file_read_iter+0x96/0x180 vfs_read+0x1b1/0x300 Our analysis reveals that the ROM space's start address is 0xffa0000007f30000, and size is 0x10000. Because of broken ROM space, before calling readl(pds), the pds's value is 0xffa0000007f3ffff, which is already pointed to the ROM space end, invoking readl() would read 4 bytes therefore cause an out-of-bounds access and trigger a crash. Fix this by adding image header and data structure checking. We also found another crash on arm64 machine: Unable to handle kernel paging request at virtual address ffff8000dd1393ff Mem abort info: ESR = 0x0000000096000021 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault The call trace is the same with x86_64, but the crash reason is that the data structure addr is not aligned with 4, and arm64 machine report "alignment fault". Fix this by adding alignment checking. [bhelgaas: shorten function names, wrap comments]
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/pci/rom.c
- What this is
- PCI SUBSYSTEMMAINTAINERS section matched on drivers/pci/ · linux-pci@vger.kernel.org · Supported
Check it on the machine
grep -w CONFIG_PCI /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormy
- trixieYnot built on armel/rpi
- forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Y
- built in where it is built at all; some flavours do not build it
- Build switch
- CONFIG_PCI
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.7 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 7.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/pci
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.5 | 6.1.178 | cd5b242d5848 |
| 4.5 | 6.6.145 | 4997873e3abb |
| 4.5 | 6.12.97 | 724042f8f98d |
| 4.5 | 6.18.40 | 1d495446ec7a |
| 4.5 | 7.1.5 | 721ad5b72448 |
| 4.5 | 7.2 | 538796b807fc |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is reached only through local kernel paths—sysfs rom reads, VFIO PCI ROM region access, or pci_map_rom() during driver probe—not via any network-facing handler.
- AC:LAttack complexity, low
- An attacker fully controls option-ROM header fields on a malicious or broken PCI device and can reliably craft pointers/lengths that place MMIO reads at the ROM window edge to trigger the fault.
- PR:NPrivileges required, none
- Exploitation requires no OS privileges when a crafted option ROM on a hot-plugged PCIe/Thunderbolt device is parsed during automatic driver probe; VFIO ROM access also needs only standard device file permissions.
- UI:NUser interaction, none
- No victim interaction is required beyond attacker-initiated local ROM access or automatic kernel parsing when a malicious PCI device is inserted and bound to a driver.
- S:UScope, unchanged
- The impact is a kernel page fault/panic within the host kernel from malformed ROM parsing; it does not cross VM, IOMMU, or other security boundaries.
- C:HConfidentiality impact, high
- pci_get_rom_size() performs unchecked readw/readl on attacker-controlled offsets, causing out-of-bounds MMIO reads past the ioremap window before faulting (CWE-125).
- I:NIntegrity impact, none
- The bug is an out-of-bounds read that faults immediately; it does not modify kernel memory, device state, or provide a write/control-flow primitive.
- A:HAvailability impact, high
- Confirmed kernel crashes on x86_64 (page fault) and arm64 (alignment fault) when parsing malformed ROM data, causing denial of service via kernel oops/panic.