Executive brief
The Linux kernel's MIPS memory management code contains a buffer overflow in the maar_res_walk() function that processes system RAM ranges. When a system reports more than 16 memory ranges, the function writes one memory configuration structure past the end of its fixed-size array before detecting the overflow. This could allow a local attacker to corrupt kernel memory and potentially gain elevated privileges or crash the system.
Technical details
The vulnerability is a heap buffer overflow in arch/mips/mm/init.c within the maar_res_walk() function. The root cause is an off-by-one error in bounds checking: the function uses wi->num_cfg as an index into a fixed 16-element cfg array but performs the array-full check only after writing to the indexed location. When walk_system_ram_range() reports more than 16 memory ranges, the overflow write occurs before WARN_ON() prevents num_cfg from advancing. The fix moves the bounds check before array access and returns non-zero to terminate the walk early. The vulnerability requires local kernel execution context (during memory initialization on MIPS systems with multiple RAM ranges) but could lead to kernel memory corruption and privilege escalation.
Affected products
- Linux Linux kernel Affected in MIPS architecture; patch available since commit 1b001b16bc88f3f7817e228acfd91ee01bdcfcce
Timeline
- 2026-08-28: disclosed: CVE-2026-80627 published on NVD
- 2026-05-25: patched: Original fix commit 1b001b16bc88f3f7817e228acfd91ee01bdcfcce
- 2026-07-24: patched: Backported to stable kernel tree via commit 038f068cced8e9c49e8c419f3112d909ad366a3a