What is the CVSS score of CVE-2026-80748?

CVE-2026-80748 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-80748?

Organizations using Loongson LS2K0500 or LS2K2000 processors face a critical kernel vulnerability that could enable full system compromise and data breach through local user access.. A patch is available.

How to fix or mitigate CVE-2026-80748?

Within 24 hours, identify and inventory any systems in your infrastructure using Loongson LS2K0500 or LS2K2000 SoCs with MMC storage, and assess which users have local access. Within 7 days, consult with your system vendors to obtain the patched Linux kernel version addressing the scatterlist indexing bug in the Loongson2 MMC driver subsystem and plan patching schedules for identified systems. Within 30 days, deploy the vendor patch to all affected systems and verify the patch application through kernel version checks and regression testing.

Linux Kernel CVE-2026-80748

EUVD-2026-70352 HIGH

2026-09-03 Linux

GHSA-rcvm-9rhr-j437

Buffer Overflow Linux Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access and low privilege required to trigger MMC I/O; kernel memory corruption on vulnerable Loongson2 hardware yields full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 04, 2026 - 05:30 vuln.today

CVSS changed

Sep 04, 2026 - 05:22 NVD

7.8 (HIGH)

Patch available

Sep 03, 2026 - 10:16 EUVD

CVE Published

Sep 03, 2026 - 08:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 03, 2026 - 08:26 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mmc: loongson2: Fix sg iteration in data reorder functions

In ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(), the for_each_sg() macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry. However, the code incorrectly uses '&sg[i]' and 'sg_dma_len(&sg[i])' inside the loop, which treats 'sg' as an array base and indexes it again, leading to access of wrong sg entries (or out-of-bounds if the list is not an array).

AnalysisAI

Out-of-bounds memory access in the Linux kernel's Loongson2 MMC driver allows a local authenticated user to corrupt kernel memory through incorrect scatterlist indexing in the mmc: loongson2 subsystem. The functions ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data() use for_each_sg() to iterate a scatterlist but then incorrectly re-index the current sg pointer as if it were an array base (using &sg[i]), causing access to wrong or out-of-bounds scatterlist entries. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires: (1) local authenticated access to the target system (PR:L - a shell account or equivalent), (2) the system must be running on Loongson LS2K0500 or LS2K2000 SoC hardware - this is not a general x86/ARM flaw, (3) the system must have MMC/eMMC/SD storage managed by the loongson2 MMC driver, and (4) an MMC data transfer operation must be triggered to exercise the reorder functions. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (score 7.8) reflects a local, low-privileged attacker triggering kernel memory corruption via MMC I/O operations, which is consistent with the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update the Linux kernel to a version containing the backported fix: kernel 7.2 or later, 7.1.10 or later, or 6.18.46 or later, depending on the stable branch in use. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and inventory any systems in your infrastructure using Loongson LS2K0500 or LS2K2000 SoCs with MMC storage, and assess which users have local access. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-80748 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-80748

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code