Executive brief
The Linux kernel contains an integer overflow bug in the KHO (kexec handover) memory preservation feature, which is used during system updates to preserve kernel memory across reboots. When attempting to preserve memory regions larger than 2 GiB, the kernel crashes or behaves unpredictably due to improper bit-shift calculations. This could cause system instability or failed updates on systems using this feature.
Technical details
The vulnerability is an integer overflow in the kho_preserved_memory_reserve() function within kernel/liveupdate/kexec_handover.c. The function calculates memory preservation size using a 32-bit integer shift operation (1 << (order + PAGE_SHIFT)), which can only safely shift by up to 31 bits, limiting preserved memory to 2 GiB. For larger reservations (obtainable via kho_preserve_pages() and used by memblock reserve operations), this triggers undefined behavior. The fix changes the shift operand from '1' to '1UL' (unsigned long), enabling safe operation with memory regions larger than 2 GiB. This is a low-severity defect affecting systems using KHO preservation; no exploitation in the wild has been reported.
Affected products
- Linux Linux kernel affected versions include kernels with KHO support (approximately 6.0 and later)
Timeline
- 2026-09-11: disclosed: CVE-2026-89568 published
- 2026-07-29: patched: Fix committed upstream (commit 3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded)
- 2026-09-07: patched: Fix backported to stable kernels (commit 42a6f03cf352eb6e6dbeef95e75e686f4cdb9bd1)