CVE-2026-80723

of: reserved_mem: prevent OOB when too many dynamic regions are defined

State: Published
Severity: 8.4 High
Published: Aug 28, 2026
Updated: Oct 16, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

of: reserved_mem: prevent OOB when too many dynamic regions are defined

On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS.

If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, fdt_scan_reserved_mem() writes past the end of the local array.

Add a bounds check that logs an error and skips the excess regions, restoring the original behavior.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	9a0fe62f93ede02c27aaca81112af1e59c8c0979 to before 68d27250c9e81ab7764603e346c2b1017cb53adfAffected 8a6e02d0c00e7b62e6acb74146878bb91e9e7e31 to before cfa7e2734877330d6c10e0f33953905486c4530cAffected 8a6e02d0c00e7b62e6acb74146878bb91e9e7e31 to before de8ccbd6bf4efe7a059e2c483789936009e10f42Affected 8a6e02d0c00e7b62e6acb74146878bb91e9e7e31 to before db3dbdfea1b8f38774419c5c2c14e4b81c48708dAffected 6.12.13 to before 6.12.103Affected
LinuxLinux	6.13Affected before 6.13Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

9a0fe62f93ede02c27aaca81112af1e59c8c0979 to before 68d27250c9e81ab7764603e346c2b1017cb53adfAffected
8a6e02d0c00e7b62e6acb74146878bb91e9e7e31 to before cfa7e2734877330d6c10e0f33953905486c4530cAffected
8a6e02d0c00e7b62e6acb74146878bb91e9e7e31 to before de8ccbd6bf4efe7a059e2c483789936009e10f42Affected
8a6e02d0c00e7b62e6acb74146878bb91e9e7e31 to before db3dbdfea1b8f38774419c5c2c14e4b81c48708dAffected
6.12.13 to before 6.12.103Affected

LinuxLinux

6.13Affected
before 6.13Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.