ZeroHour

CVE-2026-80645

niche

Invalid pointer dereference flaw in Linux kernel RapidIO Tsi721 driver

CVSS 3.1
8.1 high
EPSS
<1%p18
Published
()
Modified
AI analysis

CVE-2026-80645 is a logic flaw in the tsi721_db_dpc() doorbell handler of the Linux kernel's rapidio/tsi721 driver, where the 'found' flag is not reset at the start of each list iteration. As a result, after the first matching doorbell, all subsequent items are incorrectly treated as found, and if the searched item is absent, the list loop exits with the iterator pointing at invalid memory that is then dereferenced. An attacker reachable over an adjacent network path to a system using the Tsi721 RapidIO bridge can trigger the bad dereference, with high integrity and availability impact (potential kernel crash or memory-state corruption, no confidentiality impact per CVSS). Only Linux systems that have the Tsi721 RapidIO driver active are affected, which is a small embedded/industrial subset of Linux deployments. No public proof-of-concept, no CISA KEV listing, and a low 0.3% EPSS indicate exploitation is currently unknown.

What to do: Track your Linux distribution's kernel updates and install a kernel containing the corrected tsi721_db_d() fix (the 'found' flag reset) as soon as vendors ship it; no fixed version number is specified in the available data. Administrators should check whether the tsi721 module is loaded (e.g., 'lsmod | grep tsi721') and whether Tsi721 RapidIO hardware is present — systems without this driver are not exposed. Given the adjacent-network vector and lack of known exploitation, this can be prioritized in normal patching cycles for RapidIO-equipped systems.

Affected
Linux kernel rapidio/tsi721 driver (Tsi721 RapidIO PCI-to-RapidIO bridge support)
Estimated exposure
nichelikely at most in the thousands of systems worldwide — RapidIO is a niche interconnect used mainly in embedded, industrial and telecom designs, and the tsi721 driver is only loaded on Linux systems that actually have the Tsi721 PCIe bridge hardware, so the exposed population is a small…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() With a list_for_each() loop, if we don't find the item we are looking for in the list, then the loop exits with the iterator, which is "dbell" in this loop, pointing to invalid memory. This code uses the "found" variable to determine if we have found the doorbell we are looking for or not. However, the problem that the "found" variable needs to be set to false at the start of each iteration, otherwise after the first correct doorbell, then everything is marked as found. Reset the "found" to false at the start of the iteration and move the variable inside the loop.

Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

In the news

No ingested article mentions this CVE yet.