CVE-2026-80689 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
mmio_trace_rw() and mmio_trace_mapping() retrieve mmio_trace_array into tr and pass it to __trace_mmiotrace_rw() and __trace_mmiotrace_map(). If these functions are invoked while mmio_trace_array is NULL (e.g. before initialization or after disabled), accessing tr->array_buffer.buffer will result in a NULL pointer dereference crash.
Fix this by adding an explicit NULL check for tr at the beginning of __trace_mmiotrace_rw() and __trace_mmiotrace_map().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel tracing subsystem, specifically within the mmio_trace component responsible for monitoring memory-mapped I/O operations, contained a critical logic flaw that could lead to system instability. This vulnerability arises from an insufficient validation of pointer states before dereferencing them during trace data collection routines. The functions mmio_trace_rw and mmio_trace_mapping are designed to retrieve the current state of the mmio_trace_array into a local variable referred to as tr, which is then passed downstream to internal helper functions __trace_mmiotrace_rw and __trace_mmiotrace_map for actual processing. Under normal operational conditions where tracing is properly initialized and enabled, this pointer remains valid and points to allocated memory structures containing trace buffers. However, the code lacked defensive programming practices regarding null state verification prior to accessing nested members of the structure.
The technical flaw manifests when these tracing functions are invoked while mmio_trace_array is in a NULL state. This scenario typically occurs during two specific phases of system operation: first, before the subsystem has completed its initialization sequence, and second, after the tracing feature has been explicitly disabled by an administrator or through automated management tools. In both cases, the pointer tr holds a null value rather than a valid memory address. When the execution flow proceeds to access tr->array_buffer.buffer within the helper functions, it attempts to dereference this NULL pointer. This action violates standard memory safety protocols and triggers a kernel panic due to an invalid memory reference. Such crashes result in immediate system halts or reboots, effectively causing a denial of service for any processes relying on the operating system's availability.
From a security perspective, this vulnerability is classified under CWE-476, which denotes NULL Pointer Dereference. This category encompasses errors where software fails to check if a pointer value is null before using it, leading to crashes or potential exploitation vectors depending on the context and attacker capabilities. In the Linux kernel environment, while direct remote code execution via simple NULL dereferences is rare due to modern mitigations like KASLR and SMEP/SMAP, such flaws can still be leveraged in local privilege escalation scenarios if combined with other vulnerabilities or used to disrupt security monitoring tools that rely on stable tracing infrastructure. Furthermore, the lack of state validation aligns with ATT&CK technique T1499, Endpoint Denial of Service, as an attacker could potentially trigger this condition by manipulating trace control interfaces to disable mmio_trace and then forcing a read operation before proper re-initialization or handling occurs.
The operational impact of this vulnerability is primarily centered on system reliability rather than data confidentiality or integrity in the traditional sense. A successful exploitation leads to kernel oops messages followed by a complete system crash, requiring manual intervention or automatic reboot mechanisms to restore service. For environments where continuous monitoring and forensic analysis are critical, such as enterprise servers or high-availability clusters, this instability poses a significant risk to business continuity. The absence of the NULL check means that any race condition between disabling tracing and subsequent trace point hits can precipitate a crash, making the system unpredictable during maintenance windows or dynamic configuration changes.
To mitigate this vulnerability, the Linux kernel maintainers implemented an explicit NULL pointer validation at the entry points of __trace_mmiotrace_rw and __trace_mmiotrace_map. By checking if tr is null before attempting to access its members, the code ensures that no invalid memory operations are performed when tracing is inactive or uninitialized. This fix aligns with secure coding standards that mandate defensive programming practices for all pointer dereferences in kernel space. System administrators should ensure their kernels are updated to include this patch. Additionally, best practices suggest implementing robust state management within custom trace scripts and ensuring that any external tools interacting with the ftrace interface handle enable/disable states gracefully without triggering concurrent access during transition periods. Regular auditing of kernel modules for similar patterns can further enhance overall system resilience against such logic errors.