CVE-2026-80627

A flaw was found in the Linux kernel, specifically within the MIPS architecture's memory management component. The maar_res_walk() function performs an out-of-bounds write when processing memory ranges. This occurs because the function fails to check if its internal array is full before writing new data, potentially leading to memory corruption if more than 16 memory ranges are reported. A local attacker could exploit this vulnerability to cause system instability or a denial of service (DoS).

A moderate-severity out-of-bounds write was found in the Linux kernel's MIPS architecture-specific memory management code. The maar_res_walk() function uses wi->num_cfg as the index into the fixed-size wi->cfg array but checks whether the array is full only after it has filled the selected entry; when walk_system_ram_range() reports more than 16 memory ranges, one struct maar_config is written past the end of the array before WARN_ON() prevents num_cfg from advancing. On a system that reports more than 16 system RAM ranges, this can corrupt adjacent kernel memory, resulting in memory corruption, kernel instability, a kernel panic, or a denial of service; the attack vector is local. All currently listed Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams (kernel, kernel-rt, and kernel-ivos-qualcomm) are not affected by this flaw because the vulnerable code is not present in the shipped kernels: the flaw is specific to the MIPS architecture, which is not among the architectures built for Red Hat's supported kernel products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.