CVE-2026-80723

The Linux kernel's of/reserved_mem code writes past the end of a fixed-size local array during boot: fdt_scan_reserved_mem() stores every dynamically-placed /reserved-memory subnode from the device tree into an array limited to MAX_RESERVED_REGIONS entries, with no bounds check. If a booting system's device tree defines more dynamically-placed reserved-memory regions than that limit, the excess writes go out of bounds and corrupt adjacent memory during early boot. A local attacker who can influence the device tree (typically on embedded platforms) could gain kernel memory corruption at boot, potentially causing a crash or memory-corruption conditions; the CVSS vector indicates local exploitation with no privileges or user interaction required and high confidentiality, integrity, and availability impact. Only Linux systems that boot with device trees - primarily embedded, ARM, and similar platforms - and whose DTBs define unusually many dynamic reserved-memory regions are affected. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS estimates a 0.1% probability of exploitation in the next 30 days.

What to do: Update kernels to builds containing the upstream 'of: reserved_mem: prevent OOB when too many dynamic regions are defined' commit and track vendor advisories for backports, since no fixed version numbers are provided in the source data. As an interim measure, verify that boot device trees define fewer dynamically-placed /reserved-memory regions than the kernel's MAX_RESERVED_REGIONS limit and watch boot logs for the new bounds-check warning. Exposure is confined to systems where the device tree supplied at boot is unusually large or locally controllable.