CVE-2026-80645 Overview
CVE-2026-80645 is a Linux kernel vulnerability in the rapidio/tsi721 driver. The flaw resides in the tsi721_db_dpc() function, which processes doorbell interrupts from Tsi721 RapidIO devices. The function walks a linked list using list_for_each() and relies on a found flag to determine whether the target doorbell was located. Because the found variable is not reset at the start of each iteration, entries following the first match are incorrectly treated as matches, and the loop iterator dbell can point to invalid memory when no match exists. The condition results in an out-of-bounds read and potential invalid pointer dereference in kernel context.
Critical Impact
The flaw enables adjacent-network attackers to trigger kernel memory corruption or denial of service on affected Linux systems using the Tsi721 RapidIO driver.
Affected Products
- Linux kernel builds that include the drivers/rapidio/devices/tsi721.c driver
- Distributions shipping vulnerable versions of the RapidIO Tsi721 subsystem
- Systems with IDT Tsi721 PCIe-to-SRIO hardware where the driver is loaded
Discovery Timeline
- 2026-08-28 - CVE-2026-80645 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80645
Vulnerability Analysis
The defect is a logic error in the doorbell handler tsi721_db_dpc() inside the rapidio/tsi721 driver. The handler uses a list_for_each() loop to search a linked list of registered doorbell entries. A boolean found variable is used after the loop to decide whether the iterator dbell references a valid list entry. The found variable is declared outside the loop and never reset between iterations, so once any doorbell matches, subsequent iterations retain the truthy state. After the loop exits without a real match, the code proceeds to dereference dbell, which points to the list head sentinel rather than a valid entry. This results in reads from invalid memory in the kernel address space.
Root Cause
The root cause is improper state tracking of a search flag inside a list_for_each() iteration. The fix relocates the found variable inside the loop body and resets it to false at the start of each iteration, ensuring the post-loop check accurately reflects whether the current iterator points to a valid list element.
Attack Vector
Exploitation requires the ability to send RapidIO doorbell messages to the target host over the adjacent network fabric. An attacker on the same RapidIO fabric can craft doorbell traffic that triggers the flawed search path, producing invalid dereferences in kernel context. The impact includes kernel crashes (denial of service) and potential integrity effects from operating on attacker-influenced memory. The vulnerability does not require authentication or user interaction on the target host.
No public proof-of-concept exploit is currently available. See the upstream commits referenced under Kernel Update Commit dc28a14 and Kernel Update Commit 9e775c3 for the exact source-level correction.
Detection Methods for CVE-2026-80645
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing tsi721_db_dpc, tsi721, or rapidio in dmesg and /var/log/kern.log
- Kernel general protection faults or page faults occurring shortly after RapidIO doorbell activity
- Repeated crashes or reboots on hosts equipped with IDT Tsi721 PCIe-to-SRIO adapters
Detection Strategies
- Inventory Linux hosts loading the tsi721 kernel module using lsmod | grep tsi721 and correlate against installed kernel versions
- Compare running kernel versions against the fixed commits listed in the NVD advisory to identify unpatched systems
- Monitor kernel ring buffer telemetry for stack traces originating in drivers/rapidio/devices/tsi721.c
Monitoring Recommendations
- Forward kernel logs from RapidIO-enabled hosts to a centralized logging platform for anomaly review
- Alert on process crashes and kernel faults correlated with RapidIO device activity
- Track kernel package versions across the fleet and flag hosts not aligned with vendor-supplied fixes
How to Mitigate CVE-2026-80645
Immediate Actions Required
- Apply the upstream Linux kernel patch or the distribution-provided update that includes the fix commits
- If patching is not immediately possible, unload the tsi721 module on systems that do not require RapidIO connectivity
- Restrict physical and logical access to the RapidIO fabric so only trusted endpoints can send doorbell traffic
Patch Information
The fix is available across multiple stable kernel branches. Relevant commits include Kernel Update Commit 070f356, Kernel Update Commit 13092966, Kernel Update Commit 3b5c66e, Kernel Update Commit 81c06ef, Kernel Update Commit 9e775c3, Kernel Update Commit acd54f4, Kernel Update Commit dc28a14, and Kernel Update Commit fc15e3a. Rebuild and reboot affected hosts after applying the update.
Workarounds
- Blacklist the tsi721 module in /etc/modprobe.d/ on hosts that do not require RapidIO functionality
- Segment RapidIO fabrics to prevent untrusted devices from issuing doorbell messages to production hosts
- Enable kernel crash dumping to accelerate root-cause analysis if exploitation attempts occur before patching completes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
