Description

In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() With a list_for_each() loop, if we don't find the item we are looking for in the list, then the loop exits with the iterator, which is "dbell" in this loop, pointing to invalid memory. This code uses the "found" variable to determine if we have found the doorbell we are looking for or not. However, the problem that the "found" variable needs to be set to false at the start of each iteration, otherwise after the first correct doorbell, then everything is marked as found. Reset the "found" to false at the start of the iteration and move the variable inside the loop.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-28T08:16:49.423Z",
  "pubdate": "2026-08-28T08:16:49.423Z",
  "executiveSummary": "This vulnerability is an improper pointer dereference within the RapidIO tsi721 driver of the Linux kernel.\nThe flaw stems from logic errors in the tsi721_db_dpc() function's list traversal mechanism, which fails to correctly track whether a doorbell object has been identified within a linked list.\nIf the loop concludes without locating the target, the iterator continues to reference invalid memory, leading to a kernel-level memory corruption or system crash.\nThe vulnerability poses a significant risk to system stability, potentially allowing a local attacker or a triggered hardware event to induce a Denial of Service (DoS) via kernel panic.\nThe issue affects the Linux kernel RapidIO subsystem specifically within the tsi721 device driver component.\nExploitation requires the existence of a specific race condition or a malformed RapidIO doorbell packet processing flow that forces the list traversal to fail to find an expected entry.\nThe impact is primarily localized to kernel memory safety, where unauthorized access to invalid pointers results in undefined behavior or immediate system halting.",
  "technicalDetails": "The vulnerability resides in the tsi721_db_dpc() function, which is responsible for handling doorbells in the RapidIO interconnect subsystem. The code utilizes a list_for_each() loop to iterate through a list of doorbell structures to find a match for an incoming event.\nThe root cause is a state management failure regarding the 'found' boolean variable. In the original implementation, 'found' was not reset to false at the start of each search iteration, and its scope was improperly managed. Consequently, once a single doorbell match occurred during the function's execution, the 'found' variable remained true for all subsequent checks.\nWhen the list traversal completes without successfully matching a doorbell, the list_for_each() macro leaves the iterator ('dbell') pointing to the list head or an invalid memory address that follows the list termination. Because the 'found' variable mistakenly persists as true due to the lack of reset logic, the subsequent code logic incorrectly assumes that a valid 'dbell' object was located.\nThe execution flow continues as follows: 1) A doorbell interrupt or notification triggers tsi721_db_dpc(). 2) The function enters the loop to search for a corresponding doorbell object. 3) If a search fails for a specific entry but a previous operation had succeeded, the logic incorrectly proceeds to dereference the 'dbell' pointer. 4) Since the iterator is now pointing to an invalid memory location (post-list traversal), the kernel performs an illegal pointer dereference. 5) This triggers a kernel oops or panic, resulting in an immediate system denial of service.\nThe vulnerability is technically categorized as a logic error leading to an invalid memory dereference. Because this occurs within the kernel address space, it bypasses user-mode memory protections. The impact is severe as it results in uncontrolled kernel execution flow divergence when the system attempts to perform operations on the invalid 'dbell' pointer. The statefulness of the 'found' flag acts as a persistence mechanism for the logic failure, ensuring that once the internal state is tainted by a successful lookup, all subsequent failed lookups result in unsafe pointer dereferences.\nThis issue highlights the dangers of iterator scope management in C, specifically when list traversal macros are coupled with boolean flags that lack proper initialization within the loop block. The resolution requires re-scoping the 'found' variable inside the loop and ensuring it is initialized to false at the beginning of every individual search iteration to maintain data integrity during list traversal."
}