Always-Incorrect Control Flow Implementation in Linux kernel - CVE-2026-80647
Published: August 28, 2026
Vulnerability identifier: #VU146160
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80647
CWE-ID: CWE-670
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of completion callbacks in the hns roce completion queue handling logic when processing direct mode completion queues during driver reset. A local user can trigger a driver reset with a direct mode cq present to cause a denial of service.
The issue is triggered specifically when a completion queue is allocated in direct polling mode and the device reset path invokes the completion handler unexpectedly.
Affected software
Linux kernel
How to mitigate CVE-2026-80647
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/16138ea9833d6bb1bed37a3321f282242704bf02
- https://git.kernel.org/stable/c/1e56f8886d64288cf88d80af44c7b9148aeaa98b
- https://git.kernel.org/stable/c/3f19c2a3852e6ba75f3e92dd5edc4e07f3d07f4a
- https://git.kernel.org/stable/c/95b2e44bc1e5c5d93bb58e178d914dd99a3baa6f
- https://git.kernel.org/stable/c/9f05319149c14acedb83e2c2842ec4b38992ad9f
- https://git.kernel.org/stable/c/a075a7acd155ffdd058e72eb3f4cce1207ebafa1
- https://git.kernel.org/stable/c/c028c1977b6e61eee26bb69332453efb6513f83b
- https://git.kernel.org/stable/c/e7d363c0ffa836ac1d89657686cad241392c5eb2