CVE-2026-80723: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80723 Overview

CVE-2026-80723 is an out-of-bounds write vulnerability in the Linux kernel's Open Firmware (OF) reserved-memory subsystem. The flaw resides in fdt_scan_reserved_mem(), which parses /reserved-memory subnodes from the Flattened Device Tree (FDT) during boot. The function stores dynamically-placed regions into a local array bounded by MAX_RESERVED_REGIONS without validating the count. A device tree that defines more regions than the compile-time maximum causes the function to write past the end of the array. The Linux kernel maintainers resolved the issue by adding a bounds check that logs an error and skips excess regions.

Critical Impact
A malformed or malicious device tree can trigger an out-of-bounds write during early boot, corrupting adjacent kernel memory and leading to local privilege escalation, kernel memory corruption, or denial of service.

Affected Products

Linux kernel versions prior to the fixes referenced in commits 68d2725, cfa7e27, db3dbdf, and de8ccbd
Systems that boot using a Flattened Device Tree (typically ARM, ARM64, RISC-V, and PowerPC platforms)
Embedded and IoT devices consuming untrusted or vendor-supplied device tree blobs

Discovery Timeline

2026-08-28 - CVE-2026-80723 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80723

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in the Linux kernel's device tree reserved-memory scanner. During boot, fdt_scan_reserved_mem() iterates over every /reserved-memory subnode in the device tree. For each dynamically-placed region, it appends metadata to a local array whose size is fixed at compile time by the MAX_RESERVED_REGIONS macro. The loop does not verify that the running index remains within array bounds before writing.

When the device tree defines more dynamically-placed regions than MAX_RESERVED_REGIONS, the function writes past the end of the buffer. Because this occurs during early boot with elevated privileges, the write can corrupt adjacent stack or data structures and destabilize the kernel. Exploitability depends on the attacker's ability to influence device tree content, which is possible on platforms where firmware, bootloader configuration, or overlays can be modified locally.

Root Cause

The root cause is a missing bounds check in fdt_scan_reserved_mem(). The function assumes device trees will not declare more regions than the kernel's static maximum, and it does not validate the loop counter against MAX_RESERVED_REGIONS before storing each entry. Any device tree that exceeds this limit therefore overruns the local array.

Attack Vector

Exploitation requires local access sufficient to influence the device tree consumed at boot. This includes attackers with the ability to modify the DTB in firmware storage, supply a malicious overlay, or provide a crafted device tree through a bootloader that accepts external input. No user interaction and no prior authentication in the running OS are required, because the vulnerability triggers before user space starts. The impact spans confidentiality, integrity, and availability of the kernel.

No public proof-of-concept exploit is currently available. The vulnerability mechanism is documented in the upstream kernel commits; see the Kernel Commit 68d2725 fix for technical details.

Detection Methods for CVE-2026-80723

Indicators of Compromise

Kernel boot logs containing the newly-introduced error message indicating that excess /reserved-memory regions were skipped
Unexpected early-boot kernel panics, hangs, or memory corruption traces referencing fdt_scan_reserved_mem or reserved_mem
Unauthorized modifications to device tree blobs (.dtb) or overlays in /boot or firmware storage partitions

Detection Strategies

Audit installed kernel versions across the fleet and compare against the patched stable releases referenced in the upstream commits
Inspect device tree sources and overlays for the number of /reserved-memory subnodes and flag any tree defining an unusually large count
Monitor dmesg and persistent kernel logs for warnings originating from the reserved-memory subsystem during boot

Monitoring Recommendations

Forward kernel logs from Linux endpoints and embedded systems to a centralized log platform for boot-time anomaly analysis
Track integrity of DTB files and bootloader configuration using file integrity monitoring on firmware and boot partitions
Alert on repeated unexpected reboots of ARM, ARM64, RISC-V, or PowerPC hosts, which may indicate exploitation attempts against the boot path

How to Mitigate CVE-2026-80723

Immediate Actions Required

Update to a Linux kernel that includes commits 68d27250c9e8, cfa7e2734877, db3dbdfea1b8, or de8ccbd6bf4e from the stable tree
Rebuild and redeploy custom or embedded kernels against a patched source tree for platforms that boot from a device tree
Restrict write access to firmware, bootloader configuration, and DTB storage to trusted administrators only

Patch Information

The upstream fix adds a bounds check inside fdt_scan_reserved_mem() that logs an error and skips further regions once MAX_RESERVED_REGIONS is reached, restoring the original safe behavior. Patched commits are available in the stable tree: Kernel Commit 68d2725, Kernel Commit cfa7e27, Kernel Commit db3dbdf, and Kernel Commit de8ccbd. Distribution vendors should backport the fix into supported long-term-support branches.

Workarounds

Audit device tree sources to ensure the number of /reserved-memory subnodes remains below the MAX_RESERVED_REGIONS value compiled into the running kernel
Enable Secure Boot or verified boot on affected platforms to prevent loading of unauthorized device tree blobs
Where feasible, increase MAX_RESERVED_REGIONS and rebuild the kernel if legitimate hardware configurations approach the limit

bash

# Verify the running kernel version and check for the bounds-check fix
uname -r

# Inspect the currently loaded device tree for reserved-memory subnodes
ls /proc/device-tree/reserved-memory/ 2>/dev/null | wc -l

# Review boot messages from the reserved-memory subsystem
dmesg | grep -iE 'reserved[_-]mem|fdt_scan_reserved'