Linux kernel (drivers/pci): When the kernel coalesces two adjacent host-bridge apertures it invalidates the absorbed

Impact

When the kernel coalesces two adjacent host-bridge apertures it invalidates the absorbed resource by zeroing its fields, but the validity test only looks at the end address - so a legitimate resource that happens to end at zero is silently discarded. A root-bus resource that is dropped is never registered, meaning the kernel no longer knows that range is spoken for and can hand it out again during later BAR assignment, on top of an aperture that is genuinely in use.

Who can reach it

Not attacker-triggered - it fires at enumeration time on any host bridge whose firmware or device tree describes contiguous apertures that get coalesced, and it is deterministic for a given platform rather than racy. There is no tenant or fabric path to it. It earns a place here because the consequence is in resource assignment: a bus range the kernel forgot about is a range it may reassign, and overlapping windows are how one device ends up decoding another's addresses. The reported instance is an ARM board, but the flawed check is in generic drivers/pci/probe.c and applies to any bridge that coalesces.

What to do

Boot a kernel where the invalid-resource check tests the full resource, not just .end. Interim: on affected kernels, compare the root bus resources the kernel prints at boot against what firmware advertises and treat a missing aperture as a reason not to place multi-tenant workloads on that platform.

References

Related entries

• Linux kernel (drivers/pci): Pci_device_is_present() read the Vendor/Device ID directly, which always reads as all-onesCVE-2022-50636 · Linux kernel (drivers/pci)Medium
• Linux kernel (drivers/pci): Every write to a device's reset_method sysfs attribute that contains no space leaks theCVE-2024-56745 · Linux kernel (drivers/pci)Medium
• Linux kernel (drivers/pci): Pci_bus_lock() locked every device on the bus except the bridge itself, so a secondary busCVE-2024-46750 · Linux kernel (drivers/pci)High
• Linux kernel (drivers/pci): The PCI slot-lock failure path releases a lock the caller never took, which at best warnsCVE-2026-43211 · Linux kernel (drivers/pci)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• Linux kernel (drivers/pci): An SR-IOV device that stops answering config reads makes the VF Resizable BAR restore pathCVE-2026-64460 · Linux kernel (drivers/pci)High