CVE-2026-80627 Overview
CVE-2026-80627 is an out-of-bounds write vulnerability in the Linux kernel's MIPS memory management subsystem. The flaw resides in the maar_res_walk() function, which uses wi->num_cfg as an index into the fixed-size wi->cfg array. The bounds check occurs only after the selected entry has been populated. When walk_system_ram_range() reports more than 16 memory ranges, the function writes one struct maar_config past the end of the array before WARN_ON() prevents num_cfg from advancing.
Critical Impact
An out-of-bounds write in kernel memory can corrupt adjacent kernel data structures on MIPS systems with more than 16 system RAM ranges, potentially leading to memory corruption or system instability.
Affected Products
- Linux kernel (MIPS architecture)
- MIPS memory management (arch/mips/mm) subsystem using maar_res_walk()
- Multiple stable Linux kernel branches (see referenced fix commits)
Discovery Timeline
- 2026-08-28 - CVE-2026-80627 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80627
Vulnerability Analysis
The defect lives in maar_res_walk(), a callback invoked by walk_system_ram_range() while enumerating system RAM regions on MIPS platforms. The function stores each range's Memory Accessibility Attribute Region (MAAR) configuration inside a caller-provided wi->cfg array of fixed capacity (16 entries).
The function fills wi->cfg[wi->num_cfg] first, and only afterward evaluates whether the array is full using WARN_ON(). When walk_system_ram_range() reports a 17th memory range, the write to wi->cfg[16] occurs before the guard executes. This produces a single out-of-bounds write of a struct maar_config past the end of the buffer [CWE-787].
Because the walk continues issuing callbacks until the callback returns non-zero, the original implementation kept invoking the callback for further ranges after emitting the warning. The upstream fix reorders the check and returns a non-zero status when the scratch array is full, terminating the walk cleanly.
Root Cause
The root cause is an ordering bug in bounds validation. The array-full check follows the write instead of preceding it. In addition, the callback did not signal termination to the caller after detecting the overflow condition, leaving the walk free to continue.
Attack Vector
Triggering the condition requires a MIPS system whose firmware or memory map exposes more than 16 discrete system RAM ranges to the kernel during MAAR configuration. The code path executes during early memory initialization, so exploitation is not remote and depends on platform memory topology rather than attacker-controlled input. The primary consequence is kernel memory corruption at boot, which can manifest as instability or unpredictable behavior in adjacent kernel structures.
No verified proof-of-concept code is available. See the upstream kernel commits referenced under Linux Kernel Commit ac7385af for the corrected logic.
Detection Methods for CVE-2026-80627
Indicators of Compromise
- Kernel log entries containing WARN_ON traces originating from maar_res_walk() during boot.
- Unexpected kernel oops or panic messages referencing MAAR configuration on MIPS platforms.
- Boot-time memory corruption symptoms on MIPS systems presenting a large or fragmented system RAM map.
Detection Strategies
- Inventory MIPS-based Linux hosts and identify kernel versions that lack the referenced stable fix commits.
- Review dmesg output from affected devices for warnings emitted by the MAAR initialization path.
- Correlate build metadata against upstream stable branches to confirm whether the fix (commits including ac7385af1dca and 038f068cced8) has been backported.
Monitoring Recommendations
- Centralize kernel logs from MIPS endpoints and alert on warnings tied to memory initialization.
- Track kernel package versions across fleets and flag hosts running vulnerable builds.
- Monitor unexpected reboots or early-boot failures on MIPS hardware where the memory map may exceed 16 ranges.
How to Mitigate CVE-2026-80627
Immediate Actions Required
- Apply the upstream Linux kernel patch series referenced in the NVD entry to all affected MIPS systems.
- Prioritize MIPS platforms whose firmware exposes more than 16 system RAM ranges, as these are the only systems that can trigger the out-of-bounds write.
- Rebuild and redeploy custom kernels that include arch/mips/mm code paths after integrating the fix.
Patch Information
The Linux kernel maintainers have merged the fix across multiple stable branches. The corrected maar_res_walk() performs the full-array check before selecting a slot and returns a non-zero value when the scratch array is full, causing walk_system_ram_range() to terminate. Reference commits include Linux Kernel Commit 038f068, Linux Kernel Commit 1b001b1, Linux Kernel Commit 431812e, Linux Kernel Commit 44c1d90, Linux Kernel Commit 8b3e0c1, Linux Kernel Commit 92f38fe, Linux Kernel Commit a594100, and Linux Kernel Commit ac7385af.
Workarounds
- No supported runtime workaround exists; the defect executes in early kernel initialization on MIPS platforms.
- Where patching is delayed, restrict deployment of vulnerable kernels to MIPS hardware whose memory map is known to contain 16 or fewer system RAM ranges.
- Validate firmware and bootloader configurations to minimize fragmentation of the reported system RAM map.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
