Linux Kernel PCIe Bandwidth Controller NULL Pointer Dereference Vulnerability

A NULL pointer dereference vulnerability has been identified in the Linux kernel's PCIe bandwidth controller. This issue arises when the BIOS fails to assign bus numbers to PCI bridges, leading the kernel to run out of available bus numbers during device enumeration. As a result, the 'subordinate' pointer in the bridge's PCI device remains NULL. The PCIe bandwidth controller does not properly check for this NULL subordinate pointer and inadvertently dereferences it, causing a kernel crash. The vulnerability affects the PCIe bandwidth control of devices below the bridge, which are rendered unusable due to the bus number assignment failure.

Impact

Exploitation of this vulnerability leads to a kernel NULL pointer dereference, causing a system crash.