GHSA-M48C-Q8RX-QXXM
Vulnerability from github – Published: 2026-08-28 09:31 – Updated: 2026-08-28 09:31In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp/sev-dev-tsm - bail out early when pdev->bus is NULL
dsm_create() initially checks pdev->bus when computing segment_id:
u8 segment_id = pdev->bus ? pci_domain_nr(pdev->bus) : 0;
But the next two lines unconditionally dereference pdev->bus via pcie_find_root_port() and especially pci_dev_id(pdev), which expands to PCI_DEVID(dev->bus->number, dev->devfn). If pdev->bus is in fact NULL, segment_id is initialised to 0 but the very next statement crashes the kernel.
smatch flags this:
drivers/crypto/ccp/sev-dev-tsm.c:253 dsm_create() error: we previously assumed 'pdev->bus' could be null (see line 251)
Make the NULL handling consistent: if pdev->bus is NULL the device has no PCI context to work with and SEV TIO setup cannot proceed, so return -ENODEV before any of the bus-dependent lookups. The remaining initialisation now runs only on the path where pdev->bus is known to be valid.
No change for callers where pdev->bus is non-NULL, which is the only case where dsm_create() did meaningful work before this change.
{
"affected": [],
"aliases": [
"CVE-2026-80651"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-28T08:16:50Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp/sev-dev-tsm - bail out early when pdev-\u003ebus is NULL\n\ndsm_create() initially checks pdev-\u003ebus when computing segment_id:\n\n\tu8 segment_id = pdev-\u003ebus ? pci_domain_nr(pdev-\u003ebus) : 0;\n\nBut the next two lines unconditionally dereference pdev-\u003ebus via\npcie_find_root_port() and especially pci_dev_id(pdev), which expands\nto PCI_DEVID(dev-\u003ebus-\u003enumber, dev-\u003edevfn). If pdev-\u003ebus is in fact\nNULL, segment_id is initialised to 0 but the very next statement\ncrashes the kernel.\n\nsmatch flags this:\n\n drivers/crypto/ccp/sev-dev-tsm.c:253 dsm_create() error: we\n previously assumed \u0027pdev-\u003ebus\u0027 could be null (see line 251)\n\nMake the NULL handling consistent: if pdev-\u003ebus is NULL the device\nhas no PCI context to work with and SEV TIO setup cannot proceed,\nso return -ENODEV before any of the bus-dependent lookups. The\nremaining initialisation now runs only on the path where pdev-\u003ebus\nis known to be valid.\n\nNo change for callers where pdev-\u003ebus is non-NULL, which is the\nonly case where dsm_create() did meaningful work before this change.",
"id": "GHSA-m48c-q8rx-qxxm",
"modified": "2026-08-28T09:31:48Z",
"published": "2026-08-28T09:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80651"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6bafd740095fb3d0e9a00540bc8f3484c38e6f85"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/930d9d36ea618a775985446a125aedeb401db522"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.