CVE-2026-72487

The root cause here is straightforward: pci_get_rom_size() dereferences ROM image pointers without validating headers or alignment. What makes this worth your attention is how the failure manifests differently depending on architecture—and what that reveals about the broader PCI subsystem. On x86_64, the kernel reads out-of-bounds from the invalid ROM pointer until hitting unmapped memory and triggering a page fault. On arm64, the same invalid pointer causes an immediate alignment fault before any out-of-bounds access occurs. The same broken ROM hardware produces entirely different crash signatures. This isn't a coincidence—it's evidence that developers tested this code exclusively in environments that tolerated the underlying logic flaw. The patch adds the missing header validation and alignment checks. But the more important question is what other functions in the pci_map_rom() and pci_read_rom() pipeline make similar undocumented assumptions about ROM validity. This vulnerability fits a recognizable genotype across the kernel's hardware interfaces: PCI ROM, ACPI tables, and device tree blobs all have a history of trusting firmware-provided pointers without boundary checking. The pattern repeats because validation is discretionary at the function level rather than enforced at the subsystem boundary. The CVSS 7.7 rating is technically correct but contextually misleading. The EPSS score of 0.0018 reflects low remote exploitability—but this isn't a remote vulnerability. It's a local hardware edge case that stress-ng triggers precisely because it's a standard system stressor in containerized and cloud environments. The real exposure is local denial-of-service in shared kernel contexts, not remote code execution. For defenders: audit the entire PCI ROM access path for consistent validation hygiene. If pci_get_rom_size() lacked these checks, other ROM handling functions likely do too. Prioritize container hosts and cloud instances running unfamiliar PCI hardware, where the blast radius extends beyond a single tenant due to shared kernel state.

Reviewed through automated stages and approved by a human before publication.