CVE-2026-80627

Description

In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maar_res_walk() maar_res_walk() uses wi->num_cfg as the index into the fixed-size wi->cfg array, but checks whether the array is full only after it has filled the selected entry. If walk_system_ram_range() reports more than 16 memory ranges, the overflow call writes one struct maar_config past the end of the array before WARN_ON() prevents num_cfg from advancing. Move the full-array check before taking the array slot and return non-zero when the scratch array is full, so walk_system_ram_range() terminates the walk instead of invoking the callback for further ranges.

Is your site exposed to CVE-2026-80627?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/038f068cced8e9c49e8c419f3112d909ad366a3a https://git.kernel.org/stable/c/1b001b16bc88f3f7817e228acfd91ee01bdcfcce https://git.kernel.org/stable/c/431812eb88c200bc3ec33b88782c8cc415842074 https://git.kernel.org/stable/c/44c1d902cf0798b60762a7a98be992b9f5ded7dd https://git.kernel.org/stable/c/8b3e0c1c63015deaf084286899f5b2d0526715de https://git.kernel.org/stable/c/92f38fe85198ace9b211bc7712b7951acfb94560 https://git.kernel.org/stable/c/a594100e147a6a67eb29189170f1df3645cda12b https://git.kernel.org/stable/c/ac7385af1dca86a5ea704c80ca4dc822083ff9e2

Frequently Asked Questions

What is CVE-2026-80627? +

In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maar_res_walk() maar_res_walk() uses wi->num_cfg as the index into the fixed-size wi->cfg array, but checks whether the array is full only after it has filled the selected entry. If walk_system_ram_range() reports more than 16 memory ranges, the overflow call writes one struct maar_config past the end of the array before WARN_ON() prevents num_cfg from advancing. Move the full-array check before taking the array slot and return non-zero when the scratch array is full, so walk_system_ram_range() terminates the walk instead of invoking the callback for further ranges.

How do I check if I'm vulnerable to CVE-2026-80627? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.