CVE-2026-80748

CVE-2026-80748 is a memory-safety bug in the Linux kernel's mmc/loongson2 driver used with Loongson 2K0500 and 2K2000 SoCs, where the ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data() functions iterate scatterlists incorrectly. Because the for_each_sg() macro already advances a pointer to the current entry, the additional &sg[i] / sg_dma_len(&sg[i]) indexing inside the loop treats that pointer as an array base, accessing the wrong scatterlist entries or reading out of bounds when the list is chained rather than a flat array. The bug is triggered when the driver processes MMC command data mapped across multiple scatterlist entries, as can occur during MMC/SD data transfers on affected hardware; a local low-privileged attacker could potentially leverage the resulting out-of-bounds access to cause kernel memory corruption, information disclosure, or a crash, consistent with the CVSS 7.8 (AV:L/PR:L, high C/I/A) rating. Only systems running a Linux kernel that includes this driver on Loongson 2K0500 or 2K2000 hardware are affected; mainstream x86/ARM systems are not. No public proof of concept is known, the issue is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Update the kernel to a release or vendor build that incorporates the upstream fix ('mmc: loongson2: Fix sg iteration in data reorder functions'); the provided data does not state a fixed version, so track vendor/stable-tree advisories for the backport. In the meantime, limit local unprivileged access on Loongson 2K0500/2K2000 systems running this driver and confirm whether your kernel configuration actually enables the loongson2 MMC driver, since unaffected configs need no action.