CVE-2026-72487

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the PCI subsystem where the kernel fails to properly validate the ROM header and data structure address before access. On x86 64 architectures, a broken ROM space can lead to an out-of-bounds access when the readl() function is called on a pointer pds that points to the end of the ROM space, resulting in a kernel crash. On arm64 architectures, a similar crash occurs due to an alignment fault when the data structure address is not aligned with 4. The issue is triggered within the pci get rom size() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.