CVE-2026-80645

A flaw was found in the Linux kernel RapidIO tsi721 driver. In the tsi721_db_dpc() function, the "found" variable used to track whether a doorbell entry was located in a list_for_each() loop is not reset at the start of each iteration, so after the first matching doorbell entry every subsequent lookup is incorrectly treated as found. When the sought entry is not actually present, the loop exits with the "dbell" iterator pointing to invalid memory, and dereferencing that iterator can cause a kernel panic. This allows a local attacker to crash the system, resulting in a denial of service, with no impact on confidentiality or integrity. Red Hat rates this flaw as Moderate severity (CVSS 5.5, local attack vector, availability impact only). No Red Hat product is affected by this flaw: the Red Hat Enterprise Linux (kernel, kernel-rt) and Red Hat In-Vehicle OS (kernel, kernel-ivos-qualcomm) packages shipped for all currently tracked streams are marked not affected because the vulnerable code is not present in the shipped kernels. The CVE.org severity of 8.1 (Important) differs from Red Hat's Moderate rating because the CVE.org CVSS vector treats this as an adjacent-network attack requiring no privileges with high integrity impact, whereas the flaw actually requires local access and results only in a denial of service.