{"apiVersion":"1.0","identifier":"CVE-2026-72487","description":"In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr before accessing We meet a crash when running stress-ng on x86_64 machine: BUG: unable to handle page fault for address: ffa0000007f40000 RIP: 0010:pci_get_rom_size+0x52/0x220 Call Trace: <TASK> pci_map_rom+0x80/0x130 pci_read_rom+0x4b/0xe0 kernfs_file_read_iter+0x96/0x180 vfs_read+0x1b1/0x300 Our analysis reveals that the ROM space-s start address is 0xffa0000007f30000, and size is 0x10000. Because of broken ROM space, before calling readl(pds), the pds-s value is 0xffa0000007f3ffff, which is already pointed to the ROM space end, invoking readl() would read 4 bytes therefore cause an out-of-bounds access and trigger a crash. Fix this by adding image header and data structure checking. We also found another crash on arm64 machine: Unable to handle kernel paging request at virtual address ffff8000dd1393ff Mem abort info: ESR = 0x0000000096000021 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault The call trace is the same with x86_64, but the crash reason is that the data structure addr is not aligned with 4, and arm64 machine report -alignment fault-. Fix this by adding alignment checking. [bhelgaas: shorten function names, wrap comments]","publishedAt":"2026-08-15T06:22:22","lastModifiedAt":"2026-08-17T06:19:16","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72487","cvssScore":7.7,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","epssProbability":0.0018,"riskScore":0.78,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72487","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72487","en":"https://www.redsauce.net/en/cves/CVE-2026-72487","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72487","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72487","de":"https://www.redsauce.net/de/cves/CVE-2026-72487","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72487","el":"https://www.redsauce.net/el/cves/CVE-2026-72487"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72487"}}