Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dynamic regions are defined On boot,… (CVE-2026-80723)

The Linux kernel vulnerability CVE-2026-80723 involves an out-of-bounds write in the function fdt_scan_reserved_mem() during boot. This function saves dynamically-placed /reserved-memory subnodes into a fixed-size local array of size MAX_RESERVED_REGIONS. If the device tree defines more than MAX_RESERVED_REGIONS such regions, the function writes past the array's end, causing memory corruption. The vulnerability was resolved by adding a bounds check that logs an error and skips any excess regions beyond the limit.

Successful exploitation could lead to memory corruption during system boot, potentially causing system instability or denial of service. The CVSS score of 8.4 indicates high impact on confidentiality, integrity, and availability. However, exploitation requires local access (AV:L) and no privileges (PR:N) or user interaction (UI:N) are needed, with low attack complexity (AC:L).

A fix has been implemented in the Linux kernel to add bounds checking in fdt_scan_reserved_mem(), preventing out-of-bounds writes. Users should apply the official kernel updates or patches that include this fix. Since this is a kernel-level vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly provided here; check the vendor or distribution advisories for the exact fixed versions and update accordingly.