CVE-2026-80723
High · 8.4CVSS
8.4
EPSS
0.1%
Published
Aug 28, 2026
CISA due date
—
Cloudanix analysis
A startup flaw in how the operating system reads its hardware setup instructions can let someone with physical access crash the machine or take control of it.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds write in fdt_scan_reserved_mem() during device-tree parsing at boot when the number of dynamically placed /reserved-memory regions exceeds MAX_RESERVED_REGIONS, corrupting adjacent kernel stack memory.
Why it matters to the business
Systems may crash or become unstable on boot, and in some cases allow local attackers to execute arbitrary code with kernel privileges, disrupting operations and requiring urgent patching to avoid downtime or compromise.
How an attack unfolds
An attacker supplies a crafted device tree blob containing more than MAX_RESERVED_REGIONS dynamically placed reserved-memory nodes; on next boot fdt_scan_reserved_mem() performs an unchecked write past the end of its local array, enabling memory corruption that can be leveraged for privilege escalation.
How to fix it
Update the Linux kernel to a version containing the bounds check that logs an error and skips excess regions; rebuild and deploy the fixed kernel image to all affected systems.
How to confirm the fix worked
Confirm the presence of the bounds-check patch in the kernel source or running kernel version; attempt to boot with a test DTB that exceeds MAX_RESERVED_REGIONS and verify an error is logged instead of a crash or corruption.
Typical attack path
- Obtain or modify bootloader configuration to load a malicious DTB
- Define excess /reserved-memory subnodes with dynamic placement
- Trigger kernel boot so fdt_scan_reserved_mem() processes the DTB
- Exploit the resulting out-of-bounds write for code execution or denial of service
How to detect it
Inspect boot logs and kernel panics for signs of memory corruption during fdt_scan_reserved_mem execution; after patching, watch for the new error message indicating excess regions were skipped.
What your security team should do
- Prioritize kernel updates on all systems that parse device trees at boot
- Audit bootloader configurations and device-tree sources for excessive dynamic reserved-memory regions
- Monitor boot logs for new error messages about skipped reserved regions after patching
The record
In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dynamic regions are defined On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS. If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, fdt_scan_reserved_mem() writes past the end of the local array. Add a bounds check that logs an error and skips the excess regions, restoring the original behavior.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|