CVE-2026-80689: tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
In the Linux kernel, the following vulnerability has been resolved:
tracing/mmiotrace: Add NULL check for mmiotracearray in logging functions
mmiotracerw() and mmiotracemapping() retrieve mmiotracearray into tr and pass it to tracemmiotracerw() and tracemmiotracemap(). If these functions are invoked while mmiotracearray is NULL (e.g. before initialization or after disabled), accessing tr->arraybuffer.buffer will result in a NULL pointer dereference crash.
Fix this by adding an explicit NULL check for tr at the beginning of tracemmiotracerw() and tracemmiotracemap().
Affected Software
Event History
Frequently Asked Questions
Under what conditions can this issue cause a crash?
The crash can occur when the mmiotrace logging functions are invoked while mmio_trace_array is NULL, such as before mmiotrace initialization or after it has been disabled. The resulting NULL pointer dereference occurs when the trace buffer is accessed.
What should be done if an immediate update is not possible?
Avoid invoking or relying on mmiotrace logging while it may be uninitialized or after it has been disabled. The resolved change adds NULL checks in __trace_mmiotrace_rw() and __trace_mmiotrace_map() to safely handle that state.