The Linux kernel scanner for device tree reserved‑memory entries allocates a fixed‑size array (size MAX_RESERVED_REGIONS) to store information about dynamically–placed regions. When a device tree contains more regions than this limit, the kernel writes past the end of the array, corrupting memory in the kernel address space. This out‑of‑bounds write is a classic buffer overflow that can overwrite control data or kernel structures, enabling an attacker to execute arbitrary code with kernel privileges or destabilize the system. The vulnerability is rooted in improper bounds checking. Based on the description, it is inferred that an attacker must supply a device tree that triggers the overflow—typically by flashing firmware or modifying the boot medium.

The flaw touches the Linux kernel itself, regardless of distribution. Any kernel that parses device tree nodes for reserved‑memory, which applies to many ARM, MIPS, and RISC‑V platforms used in embedded and IoT devices, can be affected. Systems that load a device tree with an excessive number of reserved‑memory subnodes during boot are candidates for exploitation; this includes devices that rely on custom firmware or user‑modifiable device trees.

The lack of an EPSS score means the exploitation probability cannot be quantified, and the vulnerability is not yet listed in CISA’s KEV catalog. Nonetheless, an out‑of‑bounds write in the kernel is routinely treated as a high‑risk flaw capable of privilege escalation or denial of service. The attack vector is local: an actor must control the boot configuration to supply a malicious device tree, a scenario common in compromised firmware. No public exploits are documented, but the potential impact warrants a high priority response.