Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of the

Impact

The option-ROM parser trusts the header and data-structure offsets it reads out of the device's own ROM, so a device presenting a malformed ROM makes the kernel read past the end of the mapped ROM window. Confirmed to page-fault the kernel on x86_64 and to take an alignment fault on arm64 - a panic on a shared node, and the same out-of-bounds read can pull kernel memory adjacent to the ROM mapping.

Who can reach it

The parse runs whenever something reads the device ROM - the PCI sysfs rom attribute, or the ROM region of a passthrough device. That second path is the one that matters here: a tenant VM with a GPU or NIC assigned through /dev/vfio/* reads the VFIO ROM region and the host runs pci_map_rom()/pci_get_rom_size() on ROM content the device supplies. Any device whose ROM contents are attacker-influenced (flashed firmware, a rehosted card, a malicious add-in device) turns this into a host panic. Vendor scores it as needing no privileges.

What to do

Boot a kernel with the ROM header and data-structure address/alignment checks in pci_get_rom_size(). Interim: do not expose the ROM region to guests (mask the VFIO ROM region / disable ROM BAR on assigned devices), keep the PCI sysfs rom attribute out of containers, and refuse nodes with cards whose firmware provenance you cannot vouch for.

References

Related entries

• Linux kernel (drivers/pci): An SR-IOV device that stops answering config reads makes the VF Resizable BAR restore pathCVE-2026-64460 · Linux kernel (drivers/pci)High
• Linux kernel (drivers/pci): A Downstream Port Containment event and a device removal happening at the same time leaveCVE-2024-42302 · Linux kernel (drivers/pci)Medium
• Linux kernel (drivers/pci): A pci_slot holds an uncounted pointer to the pci_bus below it, and on hot removal the busCVE-2024-53194 · Linux kernel (drivers/pci)Medium
• Linux kernel (drivers/pci): The PCI bus match callback read driver_override without the device lock, so the overrideCVE-2026-53120 · Linux kernel (drivers/pci)Medium
• Linux kernel (drivers/pci): Pm_runtime_get_sync() does not wait for an already-running .runtime_idle() callback, so aCVE-2024-35809 · Linux kernel (drivers/pci)Medium
• Linux kernel (drivers/pci): Tearing down a PF that still has SR-IOV VFs takes pci_rescan_remove_lock recursively andCVE-2026-43147 · Linux kernel (drivers/pci)Medium