Description

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(), the for_each_sg() macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry. However, the code incorrectly uses '&sg[i]' and 'sg_dma_len(&sg[i])' inside the loop, which treats 'sg' as an array base and indexes it again, leading to access of wrong sg entries (or out-of-bounds if the list is not an array).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-03T13:06:14.410Z",
  "pubdate": "2026-09-03T13:06:14.410Z",
  "executiveSummary": "This vulnerability involves an out-of-bounds (OOB) memory access flaw identified within the Loongson2 MMC controller driver in the Linux kernel.\nThe issue manifests as an improper use of scatterlist iteration macros, resulting in the dereferencing of incorrect memory addresses during data reordering operations.\nThe affected components are the ls2k0500_mmc_reorder_cmd_data and ls2k2000_mmc_reorder_cmd_data functions, which handle data buffer reordering for MMC/SD operations.\nExploitation of this vulnerability could lead to memory corruption, kernel panics, or system instability when processing malformed MMC requests.\nThe vulnerability requires no specific authentication for local triggers, but it is limited by the necessity of performing MMC-related I/O operations.\nThe risk implication is primarily focused on denial-of-service (DoS) scenarios, although improper handling of kernel memory pointers can theoretically be leveraged for more complex exploits in specific system architectures.",
  "technicalDetails": "The root cause of the vulnerability lies in the incorrect implementation of scatterlist iteration within the Loongson2 MMC driver. Specifically, the functions 'ls2k0500_mmc_reorder_cmd_data' and 'ls2k2000_mmc_reorder_cmd_data' utilize the 'for_each_sg()' macro to iterate over scatterlist entries. The 'for_each_sg' macro is designed to process each entry in a scatterlist, where the loop iterator variable (in this case, 'sg') is updated to point to the current scatterlist element during every iteration.\nThe logic error occurs within the body of these loops. The code erroneously attempts to access entries using array-indexing syntax, such as '&sg[i]' and 'sg_dma_len(&sg[i])'. Because 'sg' is already a pointer to the current entry provided by the 'for_each_sg()' iterator, treating it as an array base results in pointer arithmetic that calculates an offset relative to the current entry rather than accessing the current entry itself.\nThis leads to the software accessing memory regions that do not correspond to the intended scatterlist entries. If the scatterlist is not a contiguous array, or if 'i' is non-zero, this results in an out-of-bounds memory access. The system attempts to read metadata—such as DMA lengths or addresses—from invalid memory locations, which can cause kernel panics due to null pointer dereferences or accesses to non-mapped memory pages.\nThe attack flow requires an actor capable of triggering MMC card data operations through the affected controller. By providing a crafted scatterlist, an attacker can influence the state of the iteration. Since the driver incorrectly calculates the memory address for subsequent data processing based on the erroneous index, the kernel driver may read garbage data from the stack or heap into its internal buffer pointers or controller registers.\nThe impact is significant for system integrity. In a standard kernel execution environment, an out-of-bounds read that results in corrupted DMA parameters can lead to data being written to or read from unintended kernel memory addresses. This behavior provides a vector for system-wide instability and, depending on the kernel configuration, potential memory disclosure or arbitrary memory corruption if the driver subsequently uses these malformed pointers to perform DMA transfers to or from the hardware."
}