CVE-2026-80723

A moderate out-of-bounds write vulnerability was found in the Linux kernel's of: reserved_mem device tree handling, affecting the kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. During boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a fixed-size local array of MAX_RESERVED_REGIONS entries. If the device tree defines more dynamically-placed regions than this array can hold, the function writes past the end of the array, causing kernel memory corruption that can crash or destabilize the system during boot. Exploiting this flaw requires control over the device tree supplied to the kernel at boot time, which typically requires privileged access to the boot configuration or to the underlying hardware, so practical exposure is limited; for this reason Red Hat rates the flaw moderate (CVSS 5.5, local vector with privileges required) rather than the upstream CVEORG rating of important (8.4). Earlier Red Hat Enterprise Linux 6, 7, 8, and 9 streams and rhel-10.0.z are not affected because the vulnerable code is not present in those kernels. For the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams the fix is currently deferred to a future update; the residual risk is limited because triggering the out-of-bounds write requires an attacker-controlled device tree defining an excessive number of dynamically-placed reserved-memory regions. The upstream fix adds a bounds check that logs an error and skips the excess regions.