CVE-2026-80874
NoneCVSS
—
EPSS
0.2%
Published
Sep 4, 2026
CISA due date
—
Cloudanix analysis
On certain computers, special memory areas needed for error checking were not properly protected, so the system could accidentally use them and crash when memory ran low.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- High
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Patch
- Effort
- Low
- Patch risk
- None
What it actually does
Failure to mark DBSC5 inline ECC DRAM regions and preceding unprotected areas as reserved-memory allows the kernel allocator to claim and modify those addresses under pressure, corrupting ECC metadata and destabilizing the DRAM controller.
Why it matters to the business
Embedded and server systems using affected Renesas arm64 hardware may suffer unpredictable crashes or reboots during high-memory workloads, causing unplanned downtime and operational disruption; the low EPSS and absence from KEV indicate limited real-world exploitation urgency.
How an attack unfolds
An attacker or workload that drives memory utilization high enough forces the kernel to allocate from the unmarked ECC carveout regions; subsequent writes corrupt controller metadata and trigger system instability without requiring code execution or network access.
How to fix it
Update the Linux kernel device tree for Renesas ironhide platforms to include proper reserved-memory nodes describing both the inline ECC carveouts and the preceding unprotected DRAM regions; apply the fix merged under the referenced commit once available in mainline and distribution kernels.
How to confirm the fix worked
Inspect the running device tree (cat /proc/device-tree/reserved-memory/*) to confirm ECC carveout nodes are present and correctly sized; stress-test memory allocation to verify stability under high utilization after the update.
Typical attack path
- Identify or induce sustained high DRAM allocation pressure on the target system
- Kernel page allocator selects addresses inside unmarked ECC carveout regions
- Writes to those addresses corrupt DBSC5 inline ECC metadata
- DRAM controller encounters uncorrectable errors leading to system instability or crash
How to detect it
Review kernel and system logs for sudden DRAM controller errors or unexplained reboots coinciding with high memory usage; examine device-tree blobs on affected hardware for absence of the required reserved-memory ECC nodes.
What your security team should do
- Prioritize kernel updates containing the ECC carveout reservations on all Renesas arm64 ironhide deployments
- Add memory-pressure monitoring and alerting to detect conditions that could trigger the instability
- Review downstream device trees and boot configurations for similar missing reservations in other Renesas platforms
The record
In the Linux kernel, the following vulnerability has been resolved: arm64: dts: renesas: ironhide: Describe inline ECC carveouts The DBSC5 DRAM controller protects DRAM content using inline ECC. The inline ECC utilizes areas of DRAM for its operation, which are in the DRAM address range, but must not be accessed or modified. Describe the inline ECC carveout areas used by the DBSC5 controller on this hardware as reserved-memory, which must not be accessed. Include DRAM areas which are unprotected by ECC as well, those are parts of the DRAM which directly precede the ECC carveout. In case of high DRAM utilization, unless the inline ECC carveouts are properly reserved, Linux may use and corrupt the memory used by the DBSC5 DRAM controller for inline ECC, which would lead to the system becoming unstable.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|