A high-severity out-of-bounds memory vulnerability in the Linux kernel could allow a local attacker to cause system instability or potential code execution.

The flaw exists in the fdt_scan_reserved_mem function, where a lack of bounds checking when processing device tree reserved memory subnodes leads to an out-of-bounds write. This vulnerability is accessible at the local level and does not require authentication to trigger during the system boot process.

The vulnerability carries a CVSS score of 8.4, reflecting the potential for significant impact on system integrity and availability. Successful exploitation could lead to kernel panics, system crashes, or potentially provide an attacker with a vector for privilege escalation or arbitrary code execution within the kernel context. Such outcomes pose a critical risk to data confidentiality and operational continuity for affected environments.

Immediate Action: Update the Linux kernel to version 6.12.103, 6.18.44, 7.1.8, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system boot logs for errors related to reserved memory or device tree scanning failures, which may indicate attempted exploitation or misconfiguration.

Compensating Controls: Ensure that physical access to servers is strictly controlled and that boot loaders are secured with password protection to prevent unauthorized modification of the device tree or kernel parameters.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the critical nature of kernel-level vulnerabilities, organizations should prioritize the deployment of patched kernels across all affected infrastructure. While the requirement for local access provides a barrier, the potential for kernel-level compromise necessitates prompt remediation to maintain a secure and stable operating environment.