CVE-2026-89568: kho: fix size calculation in kho_preserved_memory_reserve()
In the Linux kernel, the following vulnerability has been resolved:
kho: fix size calculation in khopreservedmemoryreserve()
khopreservedmemoryreserve() calculates the size of a preservation by doing 1 << (order + PAGESHIFT). Since the '1' is a 32-bit integer, it can only be shifted by 31. That is, it will only work for preservations up to 2 GiB. Larger preservations will trigger undefined behaviour.
While preservations larger than 2 GiB can't be obtained via folios currently, they can be obtained via khopreservepages().
For example, memblock reservemem uses khopreservepages(). Reservations larger than 2 GiB are valid and will trigger this bug if properly aligned.
Fix it by using 1UL for shifting.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems that create properly aligned KHO preservation reservations larger than 2 GiB through kho_preserve_pages() are exposed. The description identifies memblock reserve_mem as an example path that uses kho_preserve_pages().
Can this be triggered through folio-based preservation operations?
No. Preservations larger than 2 GiB cannot currently be obtained through folios; the affected larger reservations can instead be obtained through kho_preserve_pages().
What condition is required to trigger the bug?
A preservation reservation larger than 2 GiB must be created and properly aligned. Under that condition, the 32-bit shift used for the size calculation causes undefined behavior.