In the Linux kernel’s Loongson2 MMC reordering functions, the macro for_each_sg correctly iterates over scatterlist entries, but the code incorrectly accesses elements using &sg[i] and sg_dma_len(&sg[i]). This misinterpretation treats the sg pointer as an array base and indexes it again, which can read from or write to wrong or out‑of‑bounds entries. The resulting memory corruption can corrupt kernel data structures, potentially leading to a kernel panic, data corruption, or other reliability issues. The description does not claim elevation of privilege, but the corruption could stop system operation.

The bug resides in the loongson2 series drivers of the Linux kernel, specifically the functions ls2k0500_mmc_reorder_cmd_data and ls2k2000_mmc_reorder_cmd_data. Any system running a kernel that includes these functions before the patch is potentially affected. No specific downstream kernel releases or version ranges are listed, so the vulnerability applies to all builds containing the unpatched functions.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploits. However, the nature of the defect—out‑of‑bounds access in a privileged kernel component—represents a severe security risk. The likely attack vector is a local attacker able to craft or influence MMC traffic to the affected board; the attacker would need some form of access to MMC commands, potentially via a compromised application or an embedded environment. The impact of successful exploitation could be a kernel crash or data corruption, resulting in a denial of service or further exploitation if the corrupted state is exploitable. Without publicly released exploit code, the threat remains theoretical, but the severity warrants immediate mitigation.