Executive brief
The Linux kernel's powerpc kexec_file module contains a NULL pointer dereference vulnerability in the kexec_extra_fdt_size_ppc64() function. On systems without reserved memory regions, a NULL pointer check is missing, causing a kernel panic when attempting to load a new kernel via kexec. This can result in unplanned system crashes and denial of service.
Technical details
A NULL pointer dereference vulnerability exists in the kexec_extra_fdt_size_ppc64() function in arch/powerpc/kexec/file_load_64.c. The function calls get_reserved_memory_ranges() which may return 0 while leaving the 'rmem' pointer unallocated (NULL). The code directly accesses rmem->nr_ranges without first checking if rmem is NULL, leading to a kernel panic. The vulnerability affects platforms without reserved memory regions. The fix adds a NULL check before dereferencing the rmem pointer: changing `if (rmem->nr_ranges > 0)` to `if (rmem && rmem->nr_ranges > 0)`. A patch was committed upstream by Jinjie Ruan (commit 761eda315a6e1fda3e8e2185b28430771fb1ac29) and has been applied to multiple stable kernel branches.
Affected products
- Linux Linux kernel Multiple versions (powerpc kexec_file component affected in multiple stable branches linux-5.x through linux-7.x)
Timeline
- 2026-09-16: disclosed: CVE-2026-89963 published
- 2026-07-29: patched: Upstream patch committed (761eda315a6e1fda3e8e2185b28430771fb1ac29)