CVE-2026-80748 (GCVE-0-2026-80748)

Vulnerability from cvelistv5 – Published: 2026-09-03 08:26 – Updated: 2026-09-04 04:58
VLAI
Title
mmc: loongson2: Fix sg iteration in data reorder functions
Summary
In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(), the for_each_sg() macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry. However, the code incorrectly uses '&sg[i]' and 'sg_dma_len(&sg[i])' inside the loop, which treats 'sg' as an array base and indexes it again, leading to access of wrong sg entries (or out-of-bounds if the list is not an array).
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2115772014bdac368317e997ed15016cf2792665 , < 8f7f7a6d5aed8f346a1c936fba02033c73a337dc (git)
Affected: 2115772014bdac368317e997ed15016cf2792665 , < db368164383c46f256ed8152a41ae9300e615028 (git)
Affected: 2115772014bdac368317e997ed15016cf2792665 , < 00179ed9fbe07799676e2cb63c4e7f0e7cd80a5c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mmc/host/loongson2-mmc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8f7f7a6d5aed8f346a1c936fba02033c73a337dc",
              "status": "affected",
              "version": "2115772014bdac368317e997ed15016cf2792665",
              "versionType": "git"
            },
            {
              "lessThan": "db368164383c46f256ed8152a41ae9300e615028",
              "status": "affected",
              "version": "2115772014bdac368317e997ed15016cf2792665",
              "versionType": "git"
            },
            {
              "lessThan": "00179ed9fbe07799676e2cb63c4e7f0e7cd80a5c",
              "status": "affected",
              "version": "2115772014bdac368317e997ed15016cf2792665",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mmc/host/loongson2-mmc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: loongson2: Fix sg iteration in data reorder functions\n\nIn ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(),\nthe for_each_sg() macro already iterates over the scatterlist entries,\nwith \u0027sg\u0027 pointing to the current entry. However, the code incorrectly\nuses \u0027\u0026sg[i]\u0027 and \u0027sg_dma_len(\u0026sg[i])\u0027 inside the loop, which treats\n\u0027sg\u0027 as an array base and indexes it again, leading to access of\nwrong sg entries (or out-of-bounds if the list is not an array)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the Loongson-2K MMC host driver reached via local block I/O and MMC ioctls (SD writes trigger SD_APP_SEND_NUM_WR_BLKS; card init issues SD_SWITCH/SCR), not via any network protocol; it affects LoongArch desktops, kiosks, and embedded systems with SD/eMMC slots.\nAC:L - An attacker with SD-backed storage access can reliably drive the post-DMA reorder path on every qualifying transfer; the double-indexed for_each_sg bug deterministically accesses wrong scatterlist entries whenever sg_len exceeds one, without races or uncontrollable memory layout.\nPR:L - Any unprivileged local user writing to an SD-backed filesystem or opening the mmc block device can trigger the vulnerable reorder functions; no CAP_SYS_ADMIN, init-namespace root, or user-namespace capability is required.\nUI:N - Exploitation requires only the attacker\u0027s own writes, MMC_IOC_CMD ioctl sequences, or kernel auto-enumeration after SD insertion; no separate victim mount, login, or cooperative action is needed.\nS:U - Scatterlist mis-indexing corrupts kernel heap memory within the host kernel security boundary; this is standard local privilege-escalation impact, not VM escape, IOMMU bypass, or cross-container authority change.\nC:H - sg_virt(\u0026sg[i]) on a mis-advanced pointer reads from wrong or out-of-bounds scatterlist entries, exposing adjacent kernel memory; out-of-bounds reads are rated High and can leak pointers usable for further exploitation.\nI:H - The reorder loop writes bitrev8x4/cpu_to_be32-transformed values through the mis-indexed scatterlist pointer, performing out-of-bounds kernel memory writes that can corrupt adjacent objects and enable arbitrary code execution.\nA:H - Corrupting adjacent kernel structures via the out-of-bounds scatterlist write can cause immediate kernel oops or panic; memory corruption bugs in interrupt context are rated High availability impact even when not fully weaponized."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T04:58:28.127Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8f7f7a6d5aed8f346a1c936fba02033c73a337dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/db368164383c46f256ed8152a41ae9300e615028"
        },
        {
          "url": "https://git.kernel.org/stable/c/00179ed9fbe07799676e2cb63c4e7f0e7cd80a5c"
        }
      ],
      "title": "mmc: loongson2: Fix sg iteration in data reorder functions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80748",
    "datePublished": "2026-09-03T08:26:29.532Z",
    "dateReserved": "2026-08-26T14:34:25.790Z",
    "dateUpdated": "2026-09-04T04:58:28.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80748",
      "date": "2026-09-21",
      "epss": "0.00161",
      "percentile": "0.05758"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mmc/host/loongson2-mmc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8f7f7a6d5aed8f346a1c936fba02033c73a337dc",
                    "status": "affected",
                    "version": "2115772014bdac368317e997ed15016cf2792665",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "db368164383c46f256ed8152a41ae9300e615028",
                    "status": "affected",
                    "version": "2115772014bdac368317e997ed15016cf2792665",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "00179ed9fbe07799676e2cb63c4e7f0e7cd80a5c",
                    "status": "affected",
                    "version": "2115772014bdac368317e997ed15016cf2792665",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mmc/host/loongson2-mmc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: loongson2: Fix sg iteration in data reorder functions\n\nIn ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(),\nthe for_each_sg() macro already iterates over the scatterlist entries,\nwith \u0027sg\u0027 pointing to the current entry. However, the code incorrectly\nuses \u0027\u0026sg[i]\u0027 and \u0027sg_dma_len(\u0026sg[i])\u0027 inside the loop, which treats\n\u0027sg\u0027 as an array base and indexes it again, leading to access of\nwrong sg entries (or out-of-bounds if the list is not an array)."
          }
        ],
        "id": "CVE-2026-80748",
        "lastModified": "2026-09-04T05:17:14.773",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-03T13:06:14.410",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/00179ed9fbe07799676e2cb63c4e7f0e7cd80a5c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8f7f7a6d5aed8f346a1c936fba02033c73a337dc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/db368164383c46f256ed8152a41ae9300e615028"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.