Executive brief
The Linux kernel's device tree parser can write past the end of a fixed-size buffer when a system is configured with too many reserved memory regions at boot. An attacker or misconfigured system with more than the maximum supported dynamic reserved memory regions could corrupt kernel memory, potentially compromising system stability or enabling privilege escalation.
Technical details
This is a heap buffer out-of-bounds (OOB) write vulnerability in the fdt_scan_reserved_mem() function in drivers/of/of_reserved_mem.c. The function processes device tree reserved memory subnodes and stores dynamically-placed regions in a fixed-size array (dynamic_nodes) of size MAX_RESERVED_REGIONS. When the device tree defines more dynamically-placed regions than MAX_RESERVED_REGIONS, the code writes past the array bounds. The fix adds a bounds check that compares dynamic_nodes_cnt against MAX_RESERVED_REGIONS and skips excess regions with an error log instead of writing out-of-bounds. This is a local vulnerability triggered at boot time when parsing the device tree; no network vector exists. Patches are available in Linux kernel stable branches.
Affected products
- Linux Linux kernel all versions (fix applied to stable branches 2.6.11 through 7.2)
Timeline
- 2026-08-28: disclosed: Published in NVD
- 2026-06-14: patched: Fix committed by Sang-Heon Jeon
- 2026-08-09: patched: Backported to stable kernel branches