Executive brief
The Linux kernel's device tree reserved memory subsystem contains a use-after-free vulnerability in memory allocation failure handling. When the kernel attempts to initialize reserved memory regions during boot and dynamic allocation fails, a global pointer continues to reference freed memory. Subsequent calls to look up reserved memory regions can trigger a kernel crash or potential code execution.
Technical details
The vulnerability is a use-after-free (CWE-416) in the device tree reserved memory initialization code (drivers/of/of_reserved_mem.c). When alloc_reserved_mem_array() fails to dynamically allocate a new reserved memory array, the global 'reserved_mem' pointer continues to reference the original __initdata array. The exported function of_reserved_mem_lookup() can be called post-init and will dereference this freed memory. The fix resets reserved_mem_count to 0 on allocation failure, preventing post-init dereferencing. The vulnerability requires no user interaction or privileges—it can be triggered during normal kernel operation after boot if memory lookup is invoked following a failed allocation during initialization.
Affected products
- Linux Linux kernel all versions with commit 00c9a452a235 and later (approximately 5.7+)
Timeline
- 2026-08-15: disclosed
- 2026-06-04: patched: Upstream fix commit e1686ca81dbf3edbde589b7daf312b45cbf76e03