Linux kernel (drivers/pci/pcie): PCIe bandwidth control dereferences a bridge's subordinate bus pointer without

Impact

PCIe bandwidth control dereferences a bridge's subordinate bus pointer without checking it, and that pointer stays NULL when the kernel runs out of bus numbers to assign. The node panics during PCI enumeration - it does not come up, so the capacity is simply gone rather than degraded.

Who can reach it

Not attacker-driven: the precondition is a firmware/topology condition - BIOS leaves bridges unnumbered and the kernel exhausts the bus-number space while fixing it, which happens on deep or dense bridge hierarchies. That makes it a fleet-availability item for GPU boxes with large PCIe switch fabrics or many hotplug-capable ports, and for any node whose BIOS was just updated. No tenant reachability; include it in kernel-baseline hygiene rather than in the tenant threat model.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: check dmesg on new or re-flashed hardware for 'cannot be assigned' bus-number messages before putting a node into service, and update BIOS so bridges are correctly numbered.

References