CVE-2026-80689

A flaw was found in the Linux kernel's mmiotrace component. When the mmio_trace_array is not initialized or is disabled, invoking mmio_trace_rw() or mmio_trace_mapping() can lead to a NULL pointer dereference. This can cause a system crash, resulting in a Denial of Service (DoS).

A low impact NULL pointer dereference flaw was found in the Linux kernel's mmiotrace tracing component. The mmiotrace logging helpers __trace_mmiotrace_rw() and __trace_mmiotrace_map() dereference the trace array buffer without first verifying that the global mmio_trace_array pointer is set. If mmio_trace_rw() or mmio_trace_mapping() is invoked while mmiotrace is not yet initialized or has been disabled, the kernel dereferences NULL and crashes, resulting in a local denial of service. Triggering this condition requires local access with the ability to interact with the kernel's tracing subsystem, so the impact is limited to system availability; confidentiality and integrity are not affected. The affected scope covers the kernel and kernel-rt packages in Red Hat Enterprise Linux 7 through 10 and the kernel offerings in Red Hat In-Vehicle OS. Because this flaw is rated low severity and requires privileged local interaction with the tracing subsystem, the fix is deferred for the affected update streams; the residual risk is that a local user able to exercise the mmiotrace tracing path could crash the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.