CVE-2026-80689: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80689 Overview

CVE-2026-80689 is a NULL pointer dereference vulnerability in the Linux kernel's memory-mapped I/O tracing (mmiotrace) subsystem. The flaw exists in the mmio_trace_rw() and mmio_trace_mapping() logging functions, which retrieve the mmio_trace_array global into a local tr pointer and forward it to __trace_mmiotrace_rw() and __trace_mmiotrace_map(). When these functions execute while mmio_trace_array is NULL, such as before tracer initialization or after it has been disabled, the callee dereferences tr->array_buffer.buffer and triggers a kernel crash.

Critical Impact
A NULL mmio_trace_array dereference in kernel tracing code produces a kernel oops and denial-of-service condition on the affected host.

Affected Products

Linux kernel (upstream mainline)
Linux kernel stable branches referenced by the fix commits
Distributions shipping kernels with the mmiotrace tracer enabled

Discovery Timeline

2026-08-28 - CVE-2026-80689 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80689

Vulnerability Analysis

The mmiotrace tracer in the Linux kernel records memory-mapped I/O read, write, and mapping events for driver debugging. Two entry points, mmio_trace_rw() and mmio_trace_mapping(), read the global mmio_trace_array pointer and pass it as the tr argument to internal helpers __trace_mmiotrace_rw() and __trace_mmiotrace_map().

The helpers assume tr is a valid trace_array and access tr->array_buffer.buffer without a preceding NULL check. When mmiotrace has not been initialized, or has already been torn down, mmio_trace_array is NULL. Dereferencing this pointer inside the kernel triggers an oops and halts the executing context.

The fix, applied across four stable branches, adds an explicit NULL check for tr at the top of __trace_mmiotrace_rw() and __trace_mmiotrace_map(). When tr is NULL, the functions return early instead of touching array_buffer.buffer.

Root Cause

The root cause is a missing precondition check on a shared global tracer pointer. The producer path publishes events without validating that the consumer state has been fully initialized, so a race with tracer setup or shutdown reaches code that assumes a non-NULL trace_array.

Attack Vector

No remote attack vector is documented. The condition is reachable through code paths that invoke mmiotrace instrumentation while the tracer is not active, such as driver hooks firing during a narrow initialization or teardown window. The observable outcome is a NULL pointer dereference and kernel crash rather than memory disclosure or code execution.

No verified proof-of-concept code is published for this issue. Refer to the upstream commits for the exact source-level change:

Detection Methods for CVE-2026-80689

Indicators of Compromise

Kernel oops or panic logs referencing __trace_mmiotrace_rw or __trace_mmiotrace_map in the call trace.
Crash dumps showing a NULL dereference where the faulting address maps to the offset of array_buffer.buffer inside struct trace_array.
Unexpected reboots on hosts where the mmiotrace tracer has recently been toggled or where drivers under debug invoke mmiotrace hooks.

Detection Strategies

Ingest kern.log, dmesg, and kdump output into a centralized log platform and alert on stack traces containing mmio_trace_rw or mmio_trace_mapping.
Compare running kernel versions and build IDs against a baseline of patched builds to identify hosts still exposed.
Track systemd systemd-coredump events and kernel crash counters for regressions correlated with driver load or debug tracing activity.

Monitoring Recommendations

Monitor availability metrics for kernel-caused restarts and correlate with tracing subsystem changes.
Review use of /sys/kernel/debug/tracing and the mmiotracer current_tracer setting; restrict access to root only.
Alert on repeated kernel crashes from the same host to surface exploitation attempts or unstable drivers exercising the affected code paths.

How to Mitigate CVE-2026-80689

Immediate Actions Required

Apply the patched Linux kernel build from your distribution vendor that includes the referenced stable commits.
Where patching is delayed, disable the mmiotrace tracer and restrict access to debugfs and tracefs to prevent toggling that reaches the affected code paths.
Inventory hosts by kernel version to confirm coverage across servers, workstations, and embedded Linux systems.

Patch Information

The upstream fix adds a NULL check for tr in __trace_mmiotrace_rw() and __trace_mmiotrace_map(). The change is present in the following stable commits: 12b80cdbc54cf615b4717a4e8180063408091ea2, 60234845142fddb27db89ebc00a65178421fb3a4, 876014b4eeb927146430e7591cf959a7ceb8d64a, and a20a0010eb6485f60cd64e15ebc85a4bd388642e. Rebuild or install a distribution kernel that incorporates these commits, then reboot to activate.

Workarounds

Ensure the current tracer is not set to mmiotrace on production systems: echo nop > /sys/kernel/debug/tracing/current_tracer.
Mount debugfs and tracefs with mode=0700 and root-only ownership to prevent unprivileged access to tracing controls.
Avoid loading drivers with mmiotrace instrumentation on unpatched kernels used in production.

bash

# Configuration example: disable mmiotrace and restrict tracefs access
echo nop | sudo tee /sys/kernel/debug/tracing/current_tracer
sudo chmod 700 /sys/kernel/debug
sudo chmod 700 /sys/kernel/tracing
uname -r  # verify kernel version includes the fix commits