CVE-2026-80874 Overview
CVE-2026-80874 is a Linux kernel vulnerability affecting Renesas Ironhide platforms using the DBSC5 DRAM controller. The device tree source (DTS) for the arm64 Renesas Ironhide board fails to describe inline Error Correction Code (ECC) carveout regions as reserved-memory. Without these reservations, the kernel may allocate and write to DRAM ranges the DBSC5 controller uses for inline ECC operations. Under high memory pressure, this overlap corrupts ECC metadata and destabilizes the system.
Critical Impact
Kernel memory allocations can overwrite DRAM regions reserved for the DBSC5 inline ECC controller, producing memory corruption and system instability on affected Renesas Ironhide hardware.
Affected Products
- Linux kernel builds for the arm64 Renesas Ironhide platform
- Systems using the Renesas DBSC5 DRAM controller with inline ECC enabled
- Downstream distributions shipping the unpatched Ironhide device tree source
Discovery Timeline
- 2026-09-04 - CVE-2026-80874 published to the National Vulnerability Database (NVD)
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80874
Vulnerability Analysis
The DBSC5 DRAM controller on Renesas Ironhide hardware protects memory contents using inline ECC. Inline ECC stores its parity and metadata inside the same DRAM address range it protects. Those DRAM regions remain physically present but must not be touched by software.
The upstream Ironhide device tree did not describe the ECC carveouts as reserved-memory nodes. As a result, the kernel memory allocator treats those ranges as usable RAM. When memory utilization rises, allocations spill into the ECC carveouts and into the adjacent unprotected DRAM areas that precede them. Writes to these regions overwrite controller-managed state, breaking the ECC invariants the DBSC5 relies on.
The fix adds reserved-memory descriptions for both the inline ECC carveouts and the unprotected DRAM segments directly preceding them. See kernel commits 6fa6ee7 and 7cc51bb for the device tree changes.
Root Cause
The root cause is a missing hardware description in the Renesas Ironhide arm64 DTS. The kernel has no way to learn about ECC carveouts other than through firmware or device tree metadata. Without a reserved-memory entry, the allocator considers the ranges free.
Attack Vector
This issue is a local reliability and memory-integrity defect rather than a remotely reachable vulnerability. Triggering it requires running an unpatched kernel on affected Renesas Ironhide hardware and driving DRAM utilization high enough for the allocator to reach the ECC carveout ranges. No verified exploit code or public proof-of-concept is available. The Exploit Prediction Scoring System (EPSS) probability is 0.145%.
No synthetic exploitation code is provided because no verified proof-of-concept exists. Refer to the linked kernel commits for the corrected device tree definitions.
Detection Methods for CVE-2026-80874
Indicators of Compromise
- Unexplained kernel oops, panics, or filesystem corruption on Renesas Ironhide arm64 systems running unpatched kernels.
- Machine check exceptions or DBSC5 ECC error reports appearing under high memory load.
- Application crashes and data integrity failures that correlate with peak DRAM utilization windows.
Detection Strategies
- Inventory arm64 Renesas Ironhide devices and confirm whether the running kernel includes commits 6fa6ee7 or 7cc51bb.
- Parse /proc/iomem and boot logs to verify that DBSC5 inline ECC ranges appear as reserved regions.
- Correlate ECC-related dmesg output with workload telemetry to identify systems approaching the corruption threshold.
Monitoring Recommendations
- Forward kernel logs and machine check events to a centralized logging platform for longitudinal review.
- Alert on repeated DBSC5 controller errors, out-of-memory events, or unexpected reboots on affected boards.
- Track memory pressure metrics on Ironhide fleets to catch conditions that make the defect reachable.
How to Mitigate CVE-2026-80874
Immediate Actions Required
- Update the Linux kernel and device tree binaries on Renesas Ironhide hardware to a build that includes the fixing commits.
- Rebuild and redeploy the flattened device tree (.dtb) so the reserved-memory nodes are present at boot.
- Reduce peak memory utilization on unpatched systems until updated firmware and kernels are staged.
Patch Information
Apply the upstream Linux kernel fixes in commits 6fa6ee7 and 7cc51bb. These commits add the DBSC5 inline ECC carveouts and adjacent unprotected DRAM ranges to the Renesas Ironhide DTS as reserved-memory. Both the kernel image and the corresponding device tree blob must be updated together.
Workarounds
- Constrain workload memory footprints so allocations never approach the ECC carveout ranges on unpatched boards.
- Manually reserve the affected physical ranges using bootloader memmap or equivalent kernel command line parameters where supported.
- Disable inline ECC in the platform firmware if the deployment can tolerate operating without ECC protection.
# Verify reserved-memory ranges after applying the patched device tree
cat /proc/iomem | grep -i reserved
dmesg | grep -Ei 'reserved-memory|dbsc5|ecc'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
