Linux Kernel MMC Driver Scatterlist Iteration Logic Error

CVE-2026-80748 is a logic error in the Linux kernel's Loongson2 MMC driver that causes incorrect memory access during data reordering operations. The vulnerability exists in ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data() functions, where the for_each_sg() macro already provides iteration over scatterlist entries, but the code mistakenly re-indexes the 'sg' pointer using array notation (&sg[i] and sg_dma_len(&sg[i])). This double-indexing results in access to wrong scatterlist entries or out-of-bounds memory, potentially causing kernel memory corruption, information disclosure, or denial of service. This affects systems running vulnerable Linux kernel versions with Loongson2 MMC controller support, particularly ARM/MIPS-based devices and embedded systems using this chipset.

While CVE-2026-80748 does not currently map to specific MITRE ATT&CK techniques or have Casky skill coverage, security practitioners using Casky.ai would benefit from the platform's code analysis capabilities to identify similar memory safety issues. A practitioner analyzing this vulnerability through Casky's extended reasoning would recognize this as a common kernel vulnerability pattern: improper pointer arithmetic and iterator misuse. By mapping related techniques from Casky's 754 security skills—such as memory corruption detection patterns, kernel exploitation reconnaissance (T1592), and vulnerability analysis frameworks—teams can identify analogous vulnerabilities in other drivers, firmware, or kernel subsystems. This proactive approach helps practitioners detect logic errors in kernel code that might otherwise be missed by standard static analysis, strengthening their ability to assess risk across Linux-based infrastructure and embedded device ecosystems.