CVE-2026-89568: kho: fix size calculation in kho_preserved_memory_reserve()
In the Linux kernel, the following vulnerability has been resolved:
kho: fix size calculation in khopreservedmemoryreserve()
khopreservedmemoryreserve() calculates the size of a preservation by doing 1 << (order + PAGESHIFT). Since the '1' is a 32-bit integer, it can only be shifted by 31. That is, it will only work for preservations up to 2 GiB. Larger preservations will trigger undefined behaviour.
While preservations larger than 2 GiB can't be obtained via folios currently, they can be obtained via khopreservepages().
For example, memblock reservemem uses khopreservepages(). Reservations larger than 2 GiB are valid and will trigger this bug if properly aligned.
Fix it by using 1UL for shifting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In kho_preserved_memory_reserve(), change the size calculation from 1 << (order + PAGE_SHIFT) to 1UL << (order + PAGE_SHIFT) to correctly handle preservations larger than 2 GiB.
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems that create properly aligned KHO preservation reservations larger than 2 GiB through kho_preserve_pages() are exposed. The description identifies memblock reserve_mem as an example path that uses kho_preserve_pages().
Can this be triggered through folio-based preservation operations?
No. Preservations larger than 2 GiB cannot currently be obtained through folios; the affected larger reservations can instead be obtained through kho_preserve_pages().
What condition is required to trigger the bug?
A preservation reservation larger than 2 GiB must be created and properly aligned. Under that condition, the 32-bit shift used for the size calculation causes undefined behavior.