CVE-2026-53336: Linux Kernel ONIE-TLV EEPROM Parser Infinite Loop DoS

Technical summary

The vulnerability exists in the ONIE TLV (Type-Length-Value) EEPROM layout parser within the Linux kernel's nvmem subsystem. When the parser encounters an EEPROM entry with an unknown type code (such as vendor-specific type 0x41), it fails to increment the offset pointer before the next iteration. This causes an infinite loop as the parser repeatedly attempts to process the same malformed entry without advancing through the EEPROM data structure. The fix adds proper offset increment logic for unknown entry types, allowing the parser to skip unrecognized entries and continue operation.

Business impact

On affected devices—particularly network equipment, embedded systems, and other hardware relying on ONIE-compliant EEPROM identification—this vulnerability can cause system hangs during boot or runtime EEPROM queries. This results in service unavailability and potential operational downtime. For organizations managing fleets of such devices, widespread firmware versions containing this bug could trigger coordinated outages if EEPROM parsing is triggered across multiple systems simultaneously. Remediation requires kernel updates, which may necessitate planned maintenance windows.

Affected systems

The Linux kernel is the sole affected component. Systems at risk include network switches, routers, and other embedded devices that use ONIE (Open Networking Equipment Initiative) compliant EEPROMs for hardware identification and configuration storage, particularly when the EEPROM contains vendor-specific extensions or non-standard entry types. Any Linux-based system relying on the nvmem ONIE-TLV layout driver to parse such EEPROMs could be impacted if the hardware's EEPROM deviates from baseline ONIE specifications.

Exploitability

Exploitation requires local access to trigger EEPROM parsing, typically through sysfs interfaces or kernel module initialization. An unprivileged local user cannot trigger this vulnerability; it demands either system-level processes that read EEPROM data or physical access to hardware that executes EEPROM initialization routines. The vulnerability is not remotely exploitable. However, the impact is severe for affected systems: a malicious or misconfigured EEPROM can reliably cause a kernel hang without user interaction once triggered, making it a reliable denial-of-service mechanism on targeted hardware.

Remediation

Apply a Linux kernel update that includes the fix for the ONIE-TLV EEPROM layout handler. Verify the patch against your kernel version and distribution's advisory pages. For vendors and OEMs shipping devices with ONIE EEPROMs, ensure firmware updates are deployed that contain the corrected nvmem driver code. For environments where immediate kernel patching is not feasible, consider disabling EEPROM auto-probing if the system does not require runtime EEPROM queries, though this may limit hardware visibility and management capabilities.

Patch guidance

Kernel updates addressing this vulnerability should be obtained from your Linux distribution (Red Hat, Debian, Ubuntu, SUSE, etc.) or from kernel.org. Verify the specific kernel version receiving the patch by consulting your vendor's security advisory. Apply updates during maintenance windows to avoid service interruption, particularly on devices where EEPROM initialization occurs at boot. Test the patched kernel in a non-production environment with your hardware to confirm EEPROM parsing completes without hangs.

Detection guidance

Monitor system logs for kernel hang reports or watchdog timer resets coinciding with EEPROM initialization. In syslog, look for repeated attempts to parse nvmem layout entries or absence of EEPROM enumeration messages. On systems supporting kernel tracing, enable trace points in the nvmem subsystem to observe whether the parser loops indefinitely on a single EEPROM offset. Network device administrators should review device boot logs and runtime EEPROM queries for unexpected delays or timeout events. If a device freezes when EEPROM data is accessed through sysfs (/sys/bus/nvmem/), the vulnerability is likely triggered.

Why prioritize this

Although the CVSS score is MEDIUM (5.5), this vulnerability merits prioritization in environments where ONIE-based EEPROMs are actively used. Reliable, unauthenticated denial of service on critical infrastructure equipment justifies rapid patching. Network equipment operators and embedded systems vendors should deprioritize competing patches temporarily to address this bug, as a system hang is more disruptive than many higher-scoring vulnerabilities in less critical components. The fix is low-risk and straightforward, reducing deployment friction.

Risk score, explained

The CVSS v3.1 score of 5.5 (MEDIUM) reflects a local attack vector, low privilege requirement, and high availability impact (denial of service via system hang) against a single user session or system scope. The severity is not CRITICAL because remote exploitation is impossible and the attack surface is limited to systems with ONIE EEPROMs containing vendor-specific entry types. However, the certainty of impact—once triggered, the hang is guaranteed—and the operational severity of system unavailability may warrant treating this as higher-priority than the numeric score suggests in infrastructure-heavy environments.

Frequently asked questions