{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "4be423572da1f4c11f45168e3fafda870ddac9f8"
            },
            {
              "fixed": "6bafd740095fb3d0e9a00540bc8f3484c38e6f85"
            },
            {
              "fixed": "930d9d36ea618a775985446a125aedeb401db522"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80651.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp/sev-dev-tsm - bail out early when pdev-\u003ebus is NULL\n\ndsm_create() initially checks pdev-\u003ebus when computing segment_id:\n\n\tu8 segment_id = pdev-\u003ebus ? pci_domain_nr(pdev-\u003ebus) : 0;\n\nBut the next two lines unconditionally dereference pdev-\u003ebus via\npcie_find_root_port() and especially pci_dev_id(pdev), which expands\nto PCI_DEVID(dev-\u003ebus-\u003enumber, dev-\u003edevfn). If pdev-\u003ebus is in fact\nNULL, segment_id is initialised to 0 but the very next statement\ncrashes the kernel.\n\nsmatch flags this:\n\n  drivers/crypto/ccp/sev-dev-tsm.c:253 dsm_create() error: we\n    previously assumed 'pdev-\u003ebus' could be null (see line 251)\n\nMake the NULL handling consistent: if pdev-\u003ebus is NULL the device\nhas no PCI context to work with and SEV TIO setup cannot proceed,\nso return -ENODEV before any of the bus-dependent lookups. The\nremaining initialisation now runs only on the path where pdev-\u003ebus\nis known to be valid.\n\nNo change for callers where pdev-\u003ebus is non-NULL, which is the\nonly case where dsm_create() did meaningful work before this change.",
  "id": "CVE-2026-80651",
  "modified": "2026-08-30T03:30:57.145617883Z",
  "published": "2026-08-28T06:48:59.460Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6bafd740095fb3d0e9a00540bc8f3484c38e6f85"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/930d9d36ea618a775985446a125aedeb401db522"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80651.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80651"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "crypto: ccp/sev-dev-tsm - bail out early when pdev-\u003ebus is NULL"
}