CVE-2026-80627
Received Received - Intake

Out-of-Bounds Write in Linux Kernel MIPS mm

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maar_res_walk() maar_res_walk() uses wi->num_cfg as the index into the fixed-size wi->cfg array, but checks whether the array is full only after it has filled the selected entry. If walk_system_ram_range() reports more than 16 memory ranges, the overflow call writes one struct maar_config past the end of the array before WARN_ON() prevents num_cfg from advancing. Move the full-array check before taking the array slot and return non-zero when the scratch array is full, so walk_system_ram_range() terminates the walk instead of invoking the callback for further ranges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-80627
EUVD
EUVD-2026-67503

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory safety vulnerability in the Linux kernel affecting MIPS architecture. The function maar_res_walk() writes beyond the bounds of a fixed-size array when processing more than 16 memory ranges. The issue occurs because the code checks if the array is full after writing to it, rather than before.

Detection Guidance

This vulnerability is specific to the Linux kernel's MIPS architecture and involves an out-of-bounds write in the maar_res_walk() function. Detection requires checking the kernel version and MIPS-specific configurations. Use uname -a to verify the kernel version and grep for MIPS-related configurations in the kernel source or running system.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a kernel memory corruption, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It may also enable denial-of-service conditions on affected systems.

Mitigation Strategies

Apply the latest kernel patch from your Linux distribution to resolve the out-of-bounds write issue in maar_res_walk(). If a patch is unavailable, consider disabling MIPS-specific features or restricting memory range reporting to prevent the overflow. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80627. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart