CVE-2026-80645

A flaw was found in the Linux kernel's rapidio/tsi721 component. This vulnerability arises from incorrect handling of a variable within a specific loop in the tsi721_db_dpc() function. If a particular item is not found, the system attempts to access invalid memory. This could allow a local attacker to trigger a system crash, leading to a Denial of Service (DoS).

A flaw was found in the Linux kernel RapidIO tsi721 driver. In the tsi721_db_dpc() function, the "found" variable used to track whether a doorbell entry was located in a list_for_each() loop is not reset at the start of each iteration, so after the first matching doorbell entry every subsequent lookup is incorrectly treated as found. When the sought entry is not actually present, the loop exits with the "dbell" iterator pointing to invalid memory, and dereferencing that iterator can cause a kernel panic. This allows a local attacker to crash the system, resulting in a denial of service, with no impact on confidentiality or integrity. Red Hat rates this flaw as Moderate severity (CVSS 5.5, local attack vector, availability impact only). No Red Hat product is affected by this flaw: the Red Hat Enterprise Linux (kernel, kernel-rt) and Red Hat In-Vehicle OS (kernel, kernel-ivos-qualcomm) packages shipped for all currently tracked streams are marked not affected because the vulnerable code is not present in the shipped kernels. The CVE.org severity of 8.1 (Important) differs from Red Hat's Moderate rating because the CVE.org CVSS vector treats this as an adjacent-network attack requiring no privileges with high integrity impact, whereas the flaw actually requires local access and results only in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.