CVE-2026-80689

Received Received - Intake

NULL Pointer Dereference in Linux Kernel mmio_trace

Publication date: 2026-08-28

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions mmio_trace_rw() and mmio_trace_mapping() retrieve mmio_trace_array into tr and pass it to __trace_mmiotrace_rw() and __trace_mmiotrace_map(). If these functions are invoked while mmio_trace_array is NULL (e.g. before initialization or after disabled), accessing tr->array_buffer.buffer will result in a NULL pointer dereference crash. Fix this by adding an explicit NULL check for tr at the beginning of __trace_mmiotrace_rw() and __trace_mmiotrace_map().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-14

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80689

EUVD

EUVD-2026-67424

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's tracing subsystem, specifically in the mmio_trace functions. It occurs when mmio_trace_array is NULL during calls to mmio_trace_rw() or mmio_trace_mapping(), leading to a crash when accessing tr->array_buffer.buffer.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and may not have direct network detection methods. Check kernel logs for NULL pointer dereference errors related to mmio_trace_array or mmiotrace functions. Commands like dmesg | grep -i 'mmiotrace\|NULL pointer' or journalctl -k | grep -i 'mmiotrace\|NULL pointer' may help identify crashes.

Impact Analysis

If exploited, this vulnerability could cause a system crash or denial of service by triggering a NULL pointer dereference in the kernel. It may also allow local attackers to escalate privileges or execute arbitrary code in the kernel context.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a local kernel crash issue with no data exposure or security impact described.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this vulnerability. If immediate patching is not possible, disable the mmiotrace functionality by setting the kernel parameter 'mmiotrace=off' during boot or unloading the mmiotrace module if loaded.

Hi! I’m here to help you understand CVE-2026-80689. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70