CVE-2026-80645

{"id": "CVE-2026-80645", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "48618fb4e522d9d02e217ac05f52749545c1af20", "lessThan": "9e775c3199903d7c09a52530042b1198eab705bd", "versionType": "git"}, {"status": "affected", "version": "48618fb4e522d9d02e217ac05f52749545c1af20", "lessThan": "81c06ef66c3ab6eeaa72eb790c90ae043cdb3d43", "versionType": "git"}, {"status": "affected", "version": "48618fb4e522d9d02e217ac05f52749545c1af20", "lessThan": "13092966ba5d8fb214a4efeddc87f9ed0fd2f945", "versionType": "git"}, {"status": "affected", "version": "48618fb4e522d9d02e217ac05f52749545c1af20", "lessThan": "acd54f42abbbd806464468838dbc04efd203d2be", "versionType": "git"}, {"status": "affected", "version": "48618fb4e522d9d02e217ac05f52749545c1af20", "lessThan": "3b5c66e922aa6a3331915a14520848a5b3beccc7", "versionType": "git"}, {"status": "affected", "version": "48618fb4e522d9d02e217ac05f52749545c1af20", "lessThan": "070f356ea4f419e4e85e4089381f4477f41d969e", "versionType": "git"}, {"status": "affected", "version": "48618fb4e522d9d02e217ac05f52749545c1af20", "lessThan": "dc28a14f3e4546b2b06098d24177942540581a5f", "versionType": "git"}, {"status": "affected", "version": "48618fb4e522d9d02e217ac05f52749545c1af20", "lessThan": "fc15e3a30ddd950f009c76765331783b9af94a87", "versionType": "git"}], "programFiles": ["drivers/rapidio/devices/tsi721.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"status": "unaffected", "version": "0", "lessThan": "3.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/rapidio/devices/tsi721.c"], "defaultStatus": "affected"}]}], "published": "2026-08-28T08:16:49.423", "references": [{"url": "https://git.kernel.org/stable/c/070f356ea4f419e4e85e4089381f4477f41d969e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/13092966ba5d8fb214a4efeddc87f9ed0fd2f945", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3b5c66e922aa6a3331915a14520848a5b3beccc7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/81c06ef66c3ab6eeaa72eb790c90ae043cdb3d43", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9e775c3199903d7c09a52530042b1198eab705bd", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/acd54f42abbbd806464468838dbc04efd203d2be", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dc28a14f3e4546b2b06098d24177942540581a5f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fc15e3a30ddd950f009c76765331783b9af94a87", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()\n\nWith a list_for_each() loop, if we don't find the item we are looking for\nin the list, then the loop exits with the iterator, which is \"dbell\" in\nthis loop, pointing to invalid memory.\n\nThis code uses the \"found\" variable to determine if we have found the\ndoorbell we are looking for or not. However, the problem that the \"found\"\nvariable needs to be set to false at the start of each iteration,\notherwise after the first correct doorbell, then everything is marked as\nfound.\n\nReset the \"found\" to false at the start of the iteration and move the\nvariable inside the loop."}], "lastModified": "2026-08-29T07:16:47.893", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}