CVE-2026-74491

A flaw was found in the Linux kernel. A null pointer dereference vulnerability exists within the of_pci_range_parser_one() function. This occurs when of_match_bus() returns a null value for nodes with specific range properties, which is then improperly dereferenced. An attacker could potentially exploit this to prevent a rejected node from clamping the Direct Memory Access (DMA) limit, which may lead to system instability or a denial of service.

This vulnerability is rated as having Moderate impact because triggering it requires local access and primarily results in a system crash, causing a denial of service without compromising confidentiality or integrity. The issue involves improper handling of device tree bus matching when evaluating PCI range properties in Open Firmware nodes. Red Hat Enterprise Linux releases are not affected, as the upstream regression that introduced this flaw is not present in supported enterprise kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.