Look up another CVE · open CVE-2026-80917 in the interactive tracker

CVE-2026-80917

PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

EPSS 0.2%

Published 2026-09-09 (39 days ago) by the Linux kernel CNA. Subsystem drivers/pci. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-80917 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixed	6.1.187-1	Update the kernel and reboot. Fixed in 6.1.187-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixed	6.12.107-1	Update the kernel and reboot. Fixed in 6.12.107-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.1.12-1	Update the kernel and reboot. Fixed in 7.1.12-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.12-1	Update the kernel and reboot. Fixed in 7.1.12-1. A running kernel keeps the old code until the machine restarts.
Debian 12bookworm · linux-6.12	fixedDLA-4788-1 · 2026-09-19 · text	6.12.107-1~deb12u1	Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for every config access. The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration: Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [<c038db9c>] pci_generic_config_read+0x40/0xb0 [<c038da04>] pci_bus_read_config_dword+0x50/0xb0 [<c0391e94>] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec [<c039245c>] pci_scan_single_device+0xa4/0x11c [<c0392570>] pci_scan_slot+0x9c/0x23c [<c039388c>] pci_scan_child_bus_extend+0x58/0x2f4 [<c0393db0>] pci_scan_root_bus_bridge+0x64/0xe8 [<c0393e54>] pci_host_probe+0x20/0xc8 [<c03bc6f4>] pci_host_common_probe+0x144/0x1e4 Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c, move the CAM ops definition there as pci_generic_cam_ops (mirroring pci_generic_ecam_ops) and export it for pci-host-generic.c to reference. [mani: removed timestamp from log]

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/pci/controller/pci-host-generic.c
drivers/pci/ecam.c
include/linux/pci-ecam.h

What this is: PCI DRIVER FOR GENERIC OF HOSTSMAINTAINERS section matched on drivers/pci/controller/pci-host-generic.c · linux-pci@vger.kernel.org · Maintained

Check it on the machine

grep -w CONFIG_PCI_HOST_GENERIC /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

bookwormYnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, i386/686, i386/686-pae, i386/rt/686-pae, ppc64el/powerpc64le
trixieYnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, armel/rpi, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
forky, sidYnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
bookworm · linux-6.12Ynot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k

Y: built in where it is built at all; some flavours do not build it

Build switch: CONFIG_PCI_HOST_GENERIC

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-09-09 (39 days ago)source
CVSS: no vector published, unrated
Attack vector: not published
EPSS: 0.17%, higher than 5.3% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: drivers/pci

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
5.14	5.15.218	5e52eb0290f6
5.14	6.1.185	baf9b0383ff7
5.14	6.6.154	8d08713ec83a
5.14	6.12.106	74456843f18b
5.14	6.18.47	0c55707bd5d0
5.14	7.1.11	a199293f3038
5.14	7.2.1	0916948026f6
5.14	7.3	008cb88edb41
5.12.19	0	0
5.13.4	0	0

Debian advisories

Advisory	Date	Shipped to	Debian
DLA-4788-1	2026-09-19	bookworm 6.12.107-1~deb12u1	tracker

Why the CNA scored it this way

The kernel CNA published no CVSS vector and no reasoning for CVE-2026-80917, which is why it is shown as unrated rather than given an invented score. 6,405 of the 20,413 CVEs here carry reasoning; this is not one of them.