CVE-2026-74352: of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails
Published Aug 15, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
of: reservedmem: avoid post-init UAF when allocreservedmemarray() fails
The global pointer 'reservedmem' continues to reference the reservedmemarray which lives in initdata if allocreservedmemarray() fails. ofreservedmemlookup() is exported for post-init use, that would dereference freed memory and trigger a use-after-free.
So reset reservedmemcount to 0 when allocreservedmemarray() fails.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Reset reserved_mem_count to 0 when alloc_reserved_mem_array() fails to avoid post-init use-after-free (UAF) involving reserved_mem/alloc_reserved_mem_array() and reserved_mem_array.
Linux kernel reserved_mem_count = 0
Event History
Aug 15, 2026
CVE Published
via MITRE·05:58 AM
Data Sourced
via MITRE·05:58 AM
Description