Executive brief
The Linux kernel contains a bug in the Loongson-2 MMC controller driver's data reordering functions. Incorrect scatterlist iteration can cause the driver to read from wrong memory locations or access memory out-of-bounds, potentially leading to information disclosure or system instability when handling SD/SDIO/eMMC commands.
Technical details
The vulnerability is a logic error in the scatterlist (sg) iteration within the mmc/host/loongson2-mmc.c driver. The for_each_sg() macro already advances the 'sg' pointer through the list, but the vulnerable code incorrectly indexes it again using '&sg[i]' and 'sg_dma_len(&sg[i])', treating 'sg' as an array base pointer. This causes the functions ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data() to access wrong scatterlist entries or read out-of-bounds memory. The vulnerability requires no special privileges and can be triggered by any process issuing specific MMC commands (e.g., SD_SWITCH). A patch fixing the double-indexing was committed on 2026-08-04 and backported to stable kernels.
Affected products
- Linux Linux kernel versions with loongson2 mmc driver (introduced by commits d0f8e961deae and 2115772014bd)
Timeline
- 2026-09-03: disclosed: CVE-2026-80748 published on NVD
- 2026-08-04: patched: Fix committed upstream by Binbin Zhou and Ulf Hansson
- 2026-08-23: patched: Backport to stable kernels by Greg Kroah-Hartman