CVE-2026-80748

HighCVSS 7.8/10Last modified Sep 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: loongson2: Fix sg iteration in data reorder functions

In ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(), the for_each_sg() macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry. However, the code incorrectly uses '&sg[i]' and 'sg_dma_len(&sg[i])' inside the loop, which treats 'sg' as an array base and indexes it again, leading to access of wrong sg entries (or out-of-bounds if the list is not an array).

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 3, 2026
Last modified
Sep 4, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-807497.1In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function waCVE-2026-80756.5Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App whiCVE-2026-807508.4In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_CVE-2026-807517.8In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtkCVE-2026-807528.4In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpad_spi_suspend() reCVE-2026-807538.4In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues severaCVE-2026-807547.8In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo DurinCVE-2026-80755In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission countCVE-2026-80756In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started sel_writCVE-2026-80757In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common seCVE-2026-80758In the Linux kernel, the following vulnerability has been resolved: futex: Avoid private hash use-after-free on final put futex_private_haCVE-2026-80759In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_aml: validate firmware segment lengths aml_download_fir
CVE-2026-80748: High severity, CVSS 7.8 | Vulnix