Strix
63.5K

CVE-2026-80723

HIGHCVSS 8.4/10EPSS 0.16%

Last modified

CVE-2026-80723 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dynamic regions are defined On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS. If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, fdt_scan_reserved_mem() writes past the end of the local array. Add a bounds check that logs an error and skips the excess regions, restoring the original behavior.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dynamic regions are defined On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS. If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, fdt_scan_reserved_mem() writes past the end of the local array. Add a bounds check that logs an error and skips the excess regions, restoring the original behavior.

Metrics

CVSS 3.1
8.4/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.16%

5.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 9a0fe62f93ede02c27aaca81112af1e59c8c0979, < 68d27250c9e81ab7764603e346c2b1017cb53adf; >= 8a6e02d0c00e7b62e6acb74146878bb91e9e7e31, < cfa7e2734877330d6c10e0f33953905486c4530c; >= 8a6e02d0c00e7b62e6acb74146878bb91e9e7e31, < de8ccbd6bf4efe7a059e2c483789936009e10f42; >= 8a6e02d0c00e7b62e6acb74146878bb91e9e7e31, < db3dbdfea1b8f38774419c5c2c14e4b81c48708d; >= 6.12.13, < 6.12.103
LinuxLinux6.13

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-80723?
In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dynamic regions are defined On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS. If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, fdt_scan_reserved_mem() writes past the end of the local array. Add a bounds check that logs an error and skips the excess regions, restoring the original behavior.
How severe is CVE-2026-80723?
CVE-2026-80723 has a CVSS score of 8.4/10 (HIGH severity). The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2026-80723?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-80723?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST