CVE-2026-80748 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
mmc: loongson2: Fix sg iteration in data reorder functions
In ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(), the for_each_sg() macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry. However, the code incorrectly uses '&sg[i]' and 'sg_dma_len(&sg[i])' inside the loop, which treats
'sg' as an array base and indexes it again, leading to access of wrong sg entries (or out-of-bounds if the list is not an array).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The identified vulnerability resides within the Linux kernel’s MultiMediaCard subsystem, specifically affecting the Loongson2 MMC host controller driver. This issue manifests in two critical functions responsible for reordering command and data transfers: ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(). The core technical flaw stems from a fundamental misunderstanding of how the scatter-gather list iteration macro operates. In these functions, the code utilizes the for_each_sg() macro to traverse the scatterlist entries. This standard kernel macro correctly assigns the pointer sg to point directly at each successive struct scatterlist entry in the sequence during every iteration of the loop.
Despite this correct initialization by the macro, the implementation erroneously attempts to index into sg as if it were a static array base address rather than an iterator pointer. Specifically, the code employs expressions such as &sg[i] and accesses sg_dma_len(&sg[i]) within the loop body. Since sg is already pointing to the current entry, treating it as an array base and applying an additional index i results in calculating memory addresses that are offset from the intended location by a multiple of the size of struct scatterlist. This logical error causes the driver to access incorrect scatter-gather entries or potentially read beyond the bounds of the allocated list structure if the iteration count exceeds the actual number of valid entries.
From an operational perspective, this out-of-bounds memory access poses significant risks to system stability and security. When the kernel accesses invalid memory regions during data transfer operations, it can lead to immediate kernel panics or undefined behavior depending on what lies in the adjacent memory space. If the accessed memory contains sensitive information belonging to other processes or kernel structures, there is a potential for unauthorized data disclosure. Furthermore, if an attacker can influence the scatter-gather list construction through controlled input to the MMC subsystem, they might exploit this improper indexing to trigger arbitrary code execution by overwriting critical kernel pointers or control flow mechanisms located in memory adjacent to the buffer. This vulnerability aligns with CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads data past the end of a buffer or array.
The impact is particularly severe because MMC controllers handle high-volume I/O operations frequently involved in storage and peripheral communication. A crash during these operations can result in denial of service for any system component relying on reliable block device access. Additionally, since this involves DMA mapping lengths via sg_dma_len(), incorrect values could lead to the hardware performing Direct Memory Access on unintended physical addresses, potentially corrupting data or exposing memory contents that should remain isolated. This scenario reflects aspects of CWE-787, which covers Out-of-bounds Write vulnerabilities if the subsequent logic attempts to write based on these miscalculated pointers, although the primary description emphasizes access issues.
To mitigate this vulnerability, developers must correct the iteration logic within ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(). The fix involves removing the erroneous array indexing syntax &sg[i] and replacing it with direct usage of sg or appropriate pointer arithmetic if manual traversal is required, though relying on for_each_sg() without additional indexing is the standard safe practice. By ensuring that each iteration processes the exact entry pointed to by sg, the driver will correctly map DMA addresses and lengths for all scatter-gather entries. System administrators should apply kernel updates provided by their distribution vendors that include this patch. Regular security audits of low-level hardware drivers are essential to prevent similar logical errors in memory management routines, ensuring adherence to secure coding standards such as those outlined in CERT C Coding Standard regarding pointer arithmetic and array bounds checking.