Executive brief
The Linux kernel's powerpc architecture contains a defect in memory range merging logic used during kexec (kernel crash/reboot) operations. When the kernel prepares excluded memory regions to protect them from being overwritten during a crash dump, the merging logic incorrectly truncates overlapping ranges, causing valid memory to be lost. This can result in the crash kernel overwriting active memory, leading to data corruption or system crashes.
Technical details
The __merge_memory_ranges() function in powerpc/kexec_file has a logic error in how it handles overlapping memory ranges during merge operations. The vulnerability stems from two defects: (1) comparing the current range's start against the previous element (i-1) instead of the running merge target index (idx), and (2) unconditionally overwriting the merged range's end boundary without using max() to preserve larger extents. When a larger range completely subsumes smaller ranges, the merge logic incorrectly shrinks the larger range's boundary, causing intermediate memory regions to be excluded from the kexec exclude lists. An attacker with access to trigger kexec operations could potentially craft memory layouts that exploit this truncation to cause memory corruption or denial of service in crash scenarios. The fix involves comparing against the active merged range index and using max() to preserve the larger boundary.
Affected products
- Linux Linux kernel powerpc architecture (affected version range not specified)
Timeline
- 2026-09-16: disclosed