CVE-2026-80645

Received Received - Intake

Null Pointer Dereference in Linux Kernel RapidIO Tsi721 Driver

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() With a list_for_each() loop, if we don't find the item we are looking for in the list, then the loop exits with the iterator, which is "dbell" in this loop, pointing to invalid memory. This code uses the "found" variable to determine if we have found the doorbell we are looking for or not. However, the problem that the "found" variable needs to be set to false at the start of each iteration, otherwise after the first correct doorbell, then everything is marked as found. Reset the "found" to false at the start of the iteration and move the variable inside the loop.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80645

EUVD

EUVD-2026-67521

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a list iteration in the RapidIO subsystem (tsi721) fails to reset a 'found' flag between iterations. This causes the code to incorrectly mark all subsequent doorbells as found after the first valid one, leading to potential invalid memory access when dereferencing the 'dbell' iterator.

Detection Guidance

This vulnerability is specific to the Linux kernel's RapidIO subsystem, particularly the tsi721 driver. Detection requires checking kernel logs for errors related to tsi721_db_dpc() or RapidIO operations. Use commands like dmesg | grep tsi721 or journalctl -k | grep tsi721 to search for relevant errors.

Impact Analysis

This could cause system crashes or instability in systems using the affected Linux kernel component (RapidIO/tsi721). It may lead to denial-of-service conditions or unpredictable behavior in systems relying on RapidIO communication.

Compliance Impact

This vulnerability is a local denial-of-service issue in the Linux kernel's RapidIO subsystem. It does not directly impact compliance with GDPR, HIPAA, or other major standards as it does not involve data breaches, unauthorized access, or privacy violations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-80645. If using a RapidIO device with the tsi721 driver, ensure the driver is updated or the subsystem is disabled if not in use.

Hi! I’m here to help you understand CVE-2026-80645. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70