CVE-2026-80645 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
With a list_for_each() loop, if we don't find the item we are looking for in the list, then the loop exits with the iterator, which is "dbell" in this loop, pointing to invalid memory.
This code uses the "found" variable to determine if we have found the doorbell we are looking for or not. However, the problem that the "found" variable needs to be set to false at the start of each iteration, otherwise after the first correct doorbell, then everything is marked as found.
Reset the "found" to false at the start of the iteration and move the variable inside the loop.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel driver for the Tsi721 RapidIO switch chip contains a logic error within the tsi721_db_dpc function that can lead to an invalid memory dereference, classified under CWE-416 Use After Free or CWE-825 Expired Pointer Dereference. The vulnerability arises from improper handling of list iteration and state management during doorbell interrupt processing. RapidIO is a high-performance interconnect technology often used in embedded systems and data centers for communication between processors and peripherals, making the stability of its kernel drivers critical for system integrity.
The core technical flaw involves the use of a list_for_each loop to search through a linked list of doorbells. In standard C programming with Linux kernel lists, if an item is not found during iteration, the iterator variable typically points to the head of the list or becomes invalid depending on implementation details, but crucially, it does not guarantee safe access without explicit checks. The original code relied on a boolean flag named found to track whether the target doorbell was located. However, this flag was not reset at the beginning of each iteration within the loop context where multiple items might be evaluated or if the logic flow required re-evaluation. This oversight meant that once the first correct doorbell was identified and marked as found, subsequent iterations would incorrectly assume all remaining items were also found due to the persistent state of the variable.
This logical error leads to a scenario where the iterator dbell may point to memory locations that are no longer valid or do not correspond to actual hardware resources. When the code subsequently attempts to dereference this pointer to access doorbell registers or associated data structures, it triggers an invalid memory access. In kernel space, such operations can result in immediate system crashes via a general protection fault or page fault, leading to denial of service for the entire host system. Furthermore, depending on the specific memory layout and potential exploitation vectors, there is a theoretical risk that this out-of-bounds read could be leveraged to leak sensitive kernel information, aligning with CWE-200 Information Exposure.
From an operational perspective, this vulnerability affects systems utilizing Tsi721 hardware for RapidIO connectivity. An attacker or malfunctioning peripheral triggering specific interrupt patterns could potentially induce the condition where the loop fails to find a target but leaves the iterator in an unsafe state due to the flawed found flag logic. The impact is primarily stability-related, causing kernel panics that disrupt services running on affected systems. For environments relying on high availability and real-time processing capabilities typical of RapidIO applications, such instability poses significant operational risks.
The mitigation implemented involves resetting the found variable to false at the start of each iteration scope and moving its declaration inside the loop block. This ensures that state does not leak between iterations and accurately reflects whether a match was actually located in the current pass or context. By scoping the variable correctly, the code adheres to safer programming practices recommended by CWE-754 Improper Check for Unusual or Exceptional Conditions. Developers should ensure similar list traversal patterns are audited for proper iterator validation before dereference operations occur.
Security practitioners and system administrators managing Linux-based embedded systems with Tsi21 hardware should apply the relevant kernel patch immediately to eliminate this risk. Regular updates of the operating system core components are essential as they often contain fixes for low-level driver bugs that may not have immediate user-facing symptoms but compromise underlying security postures. Monitoring logs for unexpected kernel oops or panics related to RapidIO drivers can help identify if systems were previously exposed to instability caused by this flaw before patching was applied.