CVE-2026-80645
nicheInvalid pointer dereference flaw in Linux kernel RapidIO Tsi721 driver
CVE-2026-80645 is a logic flaw in the tsi721_db_dpc() doorbell handler of the Linux kernel's rapidio/tsi721 driver, where the 'found' flag is not reset at the start of each list iteration. As a result, after the first matching doorbell, all subsequent items are incorrectly treated as found, and if the searched item is absent, the list loop exits with the iterator pointing at invalid memory that is then dereferenced. An attacker reachable over an adjacent network path to a system using the Tsi721 RapidIO bridge can trigger the bad dereference, with high integrity and availability impact (potential kernel crash or memory-state corruption, no confidentiality impact per CVSS). Only Linux systems that have the Tsi721 RapidIO driver active are affected, which is a small embedded/industrial subset of Linux deployments. No public proof-of-concept, no CISA KEV listing, and a low 0.3% EPSS indicate exploitation is currently unknown.
What to do: Track your Linux distribution's kernel updates and install a kernel containing the corrected tsi721_db_d() fix (the 'found' flag reset) as soon as vendors ship it; no fixed version number is specified in the available data. Administrators should check whether the tsi721 module is loaded (e.g., 'lsmod | grep tsi721') and whether Tsi721 RapidIO hardware is present — systems without this driver are not exposed. Given the adjacent-network vector and lack of known exploitation, this can be prioritized in normal patching cycles for RapidIO-equipped systems.
| Linux kernel rapidio/tsi721 driver (Tsi721 RapidIO PCI-to-RapidIO bridge support) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() With a list_for_each() loop, if we don't find the item we are looking for in the list, then the loop exits with the iterator, which is "dbell" in this loop, pointing to invalid memory. This code uses the "found" variable to determine if we have found the doorbell we are looking for or not. However, the problem that the "found" variable needs to be set to false at the start of each iteration, otherwise after the first correct doorbell, then everything is marked as found. Reset the "found" to false at the start of the iteration and move the variable inside the loop.
- Vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.