Executive brief
A vulnerability in the Linux kernel's memory layout driver for certain hardware components could cause the system to hang or become unresponsive. This occurs when the system encounters unexpected data types while reading hardware identification information (EEPROM). An exploit could lead to a total loss of system availability, requiring a hard reboot to recover.
Technical details
A vulnerability exists in the 'onie-tlv' NVMEM layout driver within the Linux kernel. The function 'onie_tlv_add_cells' fails to increment the data offset when it encounters an unknown TLV (Type-Length-Value) entry type, instead using a 'continue' statement that bypasses the offset update logic. This results in an infinite loop if a vendor-specific or unrecognized type is present in the EEPROM. The issue affects kernel versions starting from 6.4 (where the driver was introduced) and has been patched in various stable branches including 6.6.143, 6.12.94, 6.18.36, and 7.0.13. An attacker with the ability to influence NVMEM data or on systems with specific hardware configurations could trigger a denial of service.
Affected products
- Linux Linux Kernel 6.4 to 7.0.12
Timeline
- 2026-05-30: disclosed: Initial patch submitted by Andre Heider
- 2026-06-05: patched: Patch committed to stable tree
- 2026-07-01: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/033d498b0f473c6456be5f885be172024ad84972
- https://git.kernel.org/stable/c/4a4d21f531ccf5bb333d99b620e0d66551f3652c
- https://git.kernel.org/stable/c/4f27eb01619c36cc8e3ce9a2a9af97f145f5d1c6
- https://git.kernel.org/stable/c/ea41020b9018e31c2ea7e9d89021e3e6d7470883
- https://git.kernel.org/stable/c/fd47edeabadfaa75422009dc5894e92c4c697517