CVE-2026-74352 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails
The global pointer 'reserved_mem' continues to reference the reserved_mem_array which lives in __initdata if alloc_reserved_mem_array() fails. of_reserved_mem_lookup() is exported for post-init use, that would dereference freed memory and trigger a use-after-free.
So reset reserved_mem_count to 0 when alloc_reserved_mem_array() fails.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical use-after-free condition in the Linux kernel's device tree reserved memory management subsystem. This flaw occurs within the device tree overlay framework where the kernel attempts to allocate and manage reserved memory regions for various hardware components during system initialization. The issue stems from improper handling of memory allocation failures in the device tree parsing and memory reservation process.
The technical root cause involves a global pointer named 'reserved_mem' that maintains references to memory allocated in the __initdata section, which is intended for initialization-time data only. When the function alloc_reserved_mem_array() encounters an allocation failure during kernel boot, it fails to properly reset the global state variables that track reserved memory regions. This leaves the reserved_mem pointer pointing to memory that has already been freed or marked for deallocation, creating a dangerous situation where subsequent accesses to this memory location can result in undefined behavior.
The operational impact of this vulnerability extends beyond simple memory corruption as it affects the kernel's ability to properly manage system resources during runtime operations. The function of_reserved_mem_lookup() is exported for use by post-initialization code paths, meaning that any driver or subsystem attempting to query reserved memory regions after the initial boot process can trigger the use-after-free condition. This creates potential attack vectors where malicious actors could exploit this vulnerability to execute arbitrary code within kernel space or cause system crashes.
This vulnerability aligns with CWE-416, which specifically addresses Use After Free conditions in software systems. The flaw demonstrates poor memory management practices where deallocated memory is not properly invalidated or reset when allocation failures occur. From an attack perspective, this vulnerability maps to several ATT&CK techniques including privilege escalation through kernel exploitation and system compromise via memory corruption attacks. The issue affects the integrity of the kernel's memory management subsystem and can potentially lead to complete system compromise.
The mitigation strategy involves resetting the reserved_mem_count variable to zero whenever alloc_reserved_mem_array() fails, ensuring that the global state accurately reflects the current allocation status. This prevents any subsequent access to freed memory locations while maintaining proper kernel operation. The fix ensures that when allocation fails during initialization, the system properly cleans up its internal state rather than leaving dangling pointers that can be exploited by malicious code attempting to query reserved memory regions post-initialization.