CVE-2026-72487

A flaw was found in the Linux kernel's handling of PCI (Peripheral Component Interconnect) ROM (Read-Only Memory) space. A local attacker could trigger an out-of-bounds read or an alignment fault by providing a malformed ROM image or an unaligned data structure address. This could lead to a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because it is restricted to local execution and results exclusively in a kernel crash, without impacting system integrity or data confidentiality. Exploitation requires reading PCI expansion ROMs—typically through sysfs interfaces accessible only by privileged users—on systems where attached physical or virtual PCI devices present malformed ROM data. Consequently, standard Red Hat Enterprise Linux deployments running verified hardware configurations face minimal exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.