CVE-2026-98504

A flaw was found in the Linux kernel's PCI subsystem. When generating dynamic Open Firmware (OF) device tree properties, the kernel fails to verify that a subordinate bus exists for a PCI bridge before accessing its configuration. A local attacker or physical device configuration can trigger this vulnerability during system startup or device enumeration, leading to a NULL pointer dereference. This issue causes an early boot hang or kernel crash, resulting in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.