CVE-2026-80748: mmc: loongson2: Fix sg iteration in data reorder functions
In the Linux kernel, the following vulnerability has been resolved:
mmc: loongson2: Fix sg iteration in data reorder functions
In ls2k0500mmcreordercmddata() and ls2k2000mmcreordercmddata(), the foreachsg() macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry. However, the code incorrectly uses '&sg[i]' and 'sgdmalen(&sg[i])' inside the loop, which treats 'sg' as an array base and indexes it again, leading to access of wrong sg entries (or out-of-bounds if the list is not an array).
Affected Software
Event History
Frequently Asked Questions
Which systems are in scope?
Systems running the Linux kernel with the Loongson2 MMC driver code, specifically the ls2k0500_mmc_reorder_cmd_data() or ls2k2000_mmc_reorder_cmd_data() paths, are in scope.
How can I determine whether my kernel contains the vulnerable code?
Inspect the two data-reordering functions for use of '&sg[i]' or 'sg_dma_len(&sg[i])' inside a for_each_sg() loop. The corrected logic must use the current sg entry supplied by the macro rather than indexing sg again.
Where can I find the upstream fixes?
The provided references identify stable-kernel commits 8f7f7a6d5aed8f346a1c936fba02033c73a337dc, db368164383c46f256ed8152a41ae9300e615028, and 00179ed9fbe07799676e2cb63c4e7f0e7cd80a5c.