HIGH
of ReservedMem OOB
CVE-2026-80723
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dynamic regions are defined On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS. If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, fdt_scan_reserved_mem() writes past the end of the local array. Add a bounds check that logs an error and skips the excess regions, restoring the original behavior.
02KernelScan AI Analysis
Risk summary
A malformed device tree with more than MAX_RESERVED_REGIONS dynamically-placed reserved-memory nodes causes an out-of-bounds write into a local array during early boot. The bug is reachable only by whoever controls the device tree supplied at boot, making it a privileged boot-config issue with high impact but limited attack surface.
Vulnerability analysis
During early boot, the kernel scans the flattened device tree for reserved-memory regions and stores dynamically-placed ones into a fixed-size local array. If the device tree defines more such regions than the array can hold, the scan writes past the end, corrupting adjacent memory. The fix adds a bounds check that logs an error and skips excess regions, restoring the original cap. The vulnerable path is reached only at boot time from device-tree configuration, so an attacker must be able to supply or tamper with the device tree — typically requiring root access to the boot partition or bootloader, or physical access to the board's debug interfaces.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.12.13 | 6.12.103 | 68d27250c9e8 |
| 6.18 | — | 6.18.44 | cfa7e2734877 |
| mainline | — | 7.2 | db3dbdfea1b8 |
| 7.1 | — | 7.1.8 | de8ccbd6bf4e |
| cip/6.12 | — | 6.12.104-cip30 | 68d27250c9e8 |