CVE-2026-80723: of: reserved_mem: prevent OOB when too many dynamic regions are defined
In the Linux kernel, the following vulnerability has been resolved:
of: reservedmem: prevent OOB when too many dynamic regions are defined
On boot, fdtscanreservedmem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS.
If the device tree defines more than MAXRESERVEDREGIONS dynamically-placed regions, fdtscanreservedmem() writes past the end of the local array.
Add a bounds check that logs an error and skips the excess regions, restoring the original behavior.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In fdt_scan_reserved_mem(), add a bounds check for dynamically placed /reserved-memory subnodes; when the number exceeds MAX_RESERVED_REGIONS, log an error and skip the excess regions to prevent writes past the local array.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems are exposed if they boot a Linux kernel that processes a device tree containing more than MAX_RESERVED_REGIONS dynamically placed /reserved-memory subnodes. The overflow occurs during boot in fdt_scan_reserved_mem().
What must an attacker control to trigger the out-of-bounds write?
The triggering condition is a device tree that defines more than MAX_RESERVED_REGIONS dynamically placed reserved-memory regions. The provided data does not state how an attacker could obtain control over the device tree on a target system.
What happens after applying the fix when the limit is exceeded?
The fix adds a bounds check. The kernel logs an error and skips dynamic reserved-memory regions beyond MAX_RESERVED_REGIONS rather than writing past the local array.