{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "407d1a51921e9f28c1bcec647c2205925bd1fdab"
            },
            {
              "fixed": "ccd32fa3489cbe86a0b281da4447b4c7eadb3518"
            },
            {
              "fixed": "a6d97d10e49ae49026ae13af6c41634fce470a37"
            },
            {
              "fixed": "879c911f77b8a7862aa16079b04efc3fdc5d32ec"
            },
            {
              "fixed": "aee774588abd78f75952fd34c3fa461bc46b62c2"
            },
            {
              "fixed": "8805840aad73df7146778be243a196d48b4f6430"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.6.0"
            },
            {
              "fixed": "6.6.158"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.112"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.55"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98504.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: of_property: Omit bus properties without a subordinate bus\n\nA bridge (a device with a Type 1 header) may not have a secondary bus\nallocated (pdev-\u003esubordinate), e.g., if there are no available bus numbers\nor the bridge secondary/subordinate bus numbers are not writable.\n\nThe dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map()\ndereference pdev-\u003esubordinate without checking it.  When\nCONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer\ndereference and early boot hang.\n\nGenerate 'bus-range' and 'interrupt-map' properties only when a subordinate\nbus exists.  Keep the node and its remaining properties for bridges without\none.\n\nThe problem was latent since 407d1a51921e (\"PCI: Create device tree node\nfor bridge\"), but wasn't reachable until 1f340724419e (\"PCI: of: Create\ndevice tree PCI host bridge node\"), which appeared in v6.15.  Before\n1f340724419e, of_pci_make_dev_node() returned early because the parent OF\nnode was missing.\n\n[bhelgaas: move pdev-\u003esubordinate test to callees, commit log]",
  "id": "CVE-2026-98504",
  "modified": "2026-10-19T02:30:32.812539882Z",
  "published": "2026-10-18T15:17:05.274Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/879c911f77b8a7862aa16079b04efc3fdc5d32ec"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8805840aad73df7146778be243a196d48b4f6430"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a6d97d10e49ae49026ae13af6c41634fce470a37"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aee774588abd78f75952fd34c3fa461bc46b62c2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ccd32fa3489cbe86a0b281da4447b4c7eadb3518"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98504.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98504"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "PCI: of_property: Omit bus properties without a subordinate bus"
}