EUVD-2026-67458
GHSA-m4gx-g2g6-vwmj
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires high-privilege firmware or bootloader write access to modify device tree; AC:H reflects boot-phase memory layout variability that complicates reliable OOB write exploitation.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
of: reserved_mem: prevent OOB when too many dynamic regions are defined
On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS.
If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, fdt_scan_reserved_mem() writes past the end of the local array.
Add a bounds check that logs an error and skips the excess regions, restoring the original behavior.
AnalysisAI
Out-of-bounds memory write in the Linux kernel's device tree reserved memory subsystem allows an attacker with control over device tree content to corrupt kernel memory at boot time, with theoretical full kernel compromise (C:H/I:H/A:H). The fdt_scan_reserved_mem() function writes past the end of a fixed-size local array when a device tree blob defines more dynamically-placed /reserved-memory subnodes than MAX_RESERVED_REGIONS allows. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to modify the device tree blob (DTB/FDT) supplied to the Linux kernel at boot - typically stored in firmware flash, provided by a bootloader such as U-Boot, or embedded in the kernel image itself. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-provided CVSS 3.1 score of 8.4 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H materially overstates real-world exploitability: the PR:N designation is inconsistent with the actual attack prerequisites, as modifying a device tree blob in production requires privileged firmware or bootloader access - not a no-privilege operation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to a patched kernel release: 6.12.103 or later for the 6.12 stable branch, 6.18.44 or later for the 6.18 branch, 7.1.8 or later for the 7.1 branch, or 7.2 for mainline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify Linux systems in your environment and verify current kernel versions against CVE-2026-80723 vendor advisories, prioritizing any systems with firmware access or direct hardware modification capabilities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today