CVE-2026-80723: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80723 is an out-of-bounds (OOB) memory write vulnerability in the Linux kernel's fdt_scan_reserved_mem() function within the of: reserved_mem subsystem. During system boot, the function saves dynamically-placed /reserved-memory device tree subnodes into a fixed-size local array (MAX_RESERVED_REGIONS); if the device tree defines more regions than the array can hold, the function writes past the end of the array. Affected versions include Linux kernel 6.12.13 through 6.12.102 and kernel 6.13 through certain git commits. The vulnerability was published on August 28, 2026, with patches available the same day. The CVSS score has not been formally assigned; Feedly estimates severity as Medium with an EPSS score of 0.0 (Github Advisory, Feedly).

The root cause is a missing bounds check in fdt_scan_reserved_mem(), which iterates over /reserved-memory device tree subnodes and writes each dynamically-placed region into a stack-allocated array of size MAX_RESERVED_REGIONS without verifying the index stays within bounds (CWE-787: Out-of-bounds Write). An attacker or misconfigured device tree with more than MAX_RESERVED_REGIONS dynamic entries triggers the overflow at boot time, before most kernel protections are active. The fix adds a bounds check that logs an error and skips excess regions rather than writing out of bounds. Exploitation requires local control over the device tree configuration supplied at boot (Github Advisory, Feedly).

Successful exploitation can result in arbitrary kernel code execution or a system crash (kernel panic), as the out-of-bounds write corrupts kernel memory during the early boot phase. Because the vulnerability occurs before most security mitigations are initialized, the potential for privilege escalation or persistent compromise is elevated on affected systems. The impact is limited to systems where an attacker can influence the device tree configuration, which is typically a local or physical access scenario (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly, Github Advisory). The EPSS score is 0.0, reflecting very low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to modify or supply a malicious device tree, significantly limiting the attacker population.

Apply the available kernel patches that introduce bounds checking in fdt_scan_reserved_mem(). Fixed versions include Linux kernel 6.12.103, 6.18.44, 7.1.8, and 7.2 (mainline). The corresponding fix commits are 68d27250c9e8 (for one branch), cfa7e2734877, de8ccbd6bf4e, and db3dbdfea1b8. As a workaround, limit the number of dynamically-placed /reserved-memory subnodes in the device tree to not exceed MAX_RESERVED_REGIONS for the running kernel version (Github Advisory, Feedly).