Description

In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dynamic regions are defined On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS. If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, fdt_scan_reserved_mem() writes past the end of the local array. Add a bounds check that logs an error and skips the excess regions, restoring the original behavior.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-28T08:16:58.113Z",
  "pubdate": "2026-08-28T08:16:58.113Z",
  "executiveSummary": "The Linux kernel exhibits an out-of-bounds (OOB) write vulnerability within the device tree reserved memory scanning logic. This flaw is triggered during the boot process when the system processes an excessive number of dynamically-placed regions defined in the device tree.\nThe vulnerability type is a classic buffer overflow, specifically an out-of-bounds write occurring in the fdt_scan_reserved_mem function. The impact includes potential system instability, kernel memory corruption, or arbitrary code execution during the early boot phase.\nAffected systems include Linux kernel environments utilizing device trees that contain more dynamically-placed /reserved-memory subnodes than the pre-defined limit of MAX_RESERVED_REGIONS.\nThe risk implication is high, as the vulnerability resides in the kernel initialization path. An attacker capable of modifying the device tree blob (e.g., via compromised bootloader access, hardware-level tampering, or physical device access) can trigger this flaw.\nSuccessful exploitation requires the presence of a maliciously crafted device tree that exceeds the allocated array size, allowing an attacker to write data into adjacent kernel memory, potentially overwriting critical kernel data structures or control flow pointers.",
  "technicalDetails": "The vulnerability resides in the fdt_scan_reserved_mem() function within the Linux kernel's reserved memory handling subsystem. During the boot initialization, the kernel parses the Flattened Device Tree (FDT) to identify reserved memory regions. Specifically, it identifies nodes under the /reserved-memory path that are dynamically placed.\nThe root cause of this vulnerability is the absence of a bounds check when populating a local static array intended to store references to these reserved memory regions. The kernel defines a fixed capacity for these regions using the constant MAX_RESERVED_REGIONS. When fdt_scan_reserved_mem() encounters a device tree containing a number of dynamic reserved memory regions exceeding this constant, it continues to iterate through the device tree nodes and performs memory writes beyond the trailing edge of the static array.\nThe attack flow begins with the provision of a manipulated device tree blob to the kernel. An attacker who can influence the device tree input—typically through the bootloader stage—can craft an FDT with a count of dynamic reserved memory nodes higher than the kernel's MAX_RESERVED_REGIONS limit. When the kernel executes fdt_scan_reserved_mem(), it blindly writes metadata into the array until the predefined limit is reached, and then continues writing subsequent metadata into unauthorized memory addresses adjacent to the array.\nBecause this operation occurs during early boot, the memory layout is relatively predictable, potentially allowing an attacker to overwrite adjacent kernel data. The post-exploitation impact includes the corruption of adjacent data structures, which can lead to a kernel panic (Denial of Service) or, under favorable conditions, the hijacking of kernel-level execution flow if critical function pointers or sensitive data reside in the overflowed memory region.\nThis vulnerability is particularly dangerous because it does not require authentication or elevated user privileges in the traditional sense; the exploitation occurs at the very start of the boot sequence, effectively bypassing standard user-land security controls. The vulnerability is triggered by the FDT parsing logic, making the kernel vulnerable as soon as the firmware hands over control to the kernel with the maliciously crafted device tree configuration.\nMitigation requires implementing a strict bounds check at the point of insertion within fdt_scan_reserved_mem(). The check must ensure that the index counter does not exceed MAX_RESERVED_REGIONS before any write operation is performed, ensuring the kernel gracefully rejects or logs the excess nodes instead of continuing execution in an overflowed state."
}