CVE-2026-80645
rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() With a list_for_each() loop, if we don't find the item we are looking for in the list, then the loop exits with the iterator, which is "dbell" in this loop, pointing to invalid memory. This code uses the "found" variable to determine if we have found the doorbell we are looking for or not. However, the problem that the "found" variable needs to be set to false at the start of each iteration, otherwise after the first correct doorbell, then everything is marked as found. Reset the "found" to false at the start of the iteration and move the variable inside the loop.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
3.2
References 8
git.kernel.org
- stable/c/9e775c3199903d7c09a52530042b1198eab705bd
- stable/c/81c06ef66c3ab6eeaa72eb790c90ae043cdb3d43
- stable/c/13092966ba5d8fb214a4efeddc87f9ed0fd2f945
- stable/c/acd54f42abbbd806464468838dbc04efd203d2be
- stable/c/3b5c66e922aa6a3331915a14520848a5b3beccc7
- stable/c/070f356ea4f419e4e85e4089381f4477f41d969e
- stable/c/dc28a14f3e4546b2b06098d24177942540581a5f
- stable/c/fc15e3a30ddd950f009c76765331783b9af94a87