Cloudanix VulnDB

CVE-2026-80689

None

CVSS

—

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing safety check in Linux kernel tracing code can cause the whole system to crash unexpectedly.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing NULL check on mmio_trace_array in mmio_trace_rw() and mmio_trace_mapping() leads to dereference of a NULL pointer in __trace_mmiotrace_rw() and __trace_mmiotrace_map() when tracing is invoked before initialization or after disable, resulting in a kernel crash.

Why it matters to the business

Unexpected system crashes or denial of service on affected Linux kernels can interrupt services, cause data loss in flight, and require manual intervention or reboots to recover.

How an attack unfolds

An attacker with local access triggers mmio tracing paths while the trace array remains uninitialized, causing the kernel to dereference a NULL pointer and panic; no remote vector or known threat actor exploitation is documented.

How to fix it

Apply the upstream kernel patch that adds explicit NULL checks for tr at the start of __trace_mmiotrace_rw() and __trace_mmiotrace_map(); rebuild and deploy the fixed kernel across all affected systems.

How to confirm the fix worked

Confirm the presence of the NULL guard at the beginning of __trace_mmiotrace_rw() and __trace_mmiotrace_map() in the running kernel source or binary; attempt to exercise tracing before initialization and verify no crash occurs.

Typical attack path

  1. Obtain local execution on the target system
  2. Invoke or manipulate mmio tracing functions before the trace array is initialized or after it is disabled
  3. Trigger the vulnerable logging paths to induce NULL dereference
  4. Cause kernel panic and system crash

How to detect it

Examine kernel logs for NULL pointer dereference oops messages referencing mmiotrace functions; inspect call stacks containing mmio_trace_rw or mmio_trace_mapping around the time of a crash.

What your security team should do

  • Prioritize patching Linux kernel installations that use mmiotrace within 30 days
  • Review kernel configurations to disable unnecessary tracing features where possible
  • Monitor upstream stable kernel releases for the merged fix
  • Test the patched kernel in staging environments before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions mmio_trace_rw() and mmio_trace_mapping() retrieve mmio_trace_array into tr and pass it to __trace_mmiotrace_rw() and __trace_mmiotrace_map(). If these functions are invoked while mmio_trace_array is NULL (e.g. before initialization or after disabled), accessing tr->array_buffer.buffer will result in a NULL pointer dereference crash. Fix this by adding an explicit NULL check for tr at the beginning of __trace_mmiotrace_rw() and __trace_mmiotrace_map().

Affected packages

Ecosystem Package Introduced Fixed