CVE-2026-89963: powerpc/kexec_file: Fix null-ptr-def in extra size calculation
In the Linux kernel, the following vulnerability has been resolved:
powerpc/kexecfile: Fix null-ptr-def in extra size calculation
A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64().
On platforms without any reserved memory regions, getreservedmemoryranges() can return 0 while leaving 'rmem' unallocated as NULL. Passing it directly leads to a kernel panic when evaluating 'rmem->nrranges'.
Add a NULL check for 'rmem' to prevent this crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the kernel code in kexec_extra_fdt_size_ppc64()/extra size calculation to add a NULL check for 'rmem' so it cannot be dereferenced when get_reserved_memory_ranges() returns 0 and leaves 'rmem' unallocated as NULL.
Linux kernel (powerpc/kexec_file) Add NULL check for rmem before dereferencing rmem->nr_ranges = NULL-check
Event History
Frequently Asked Questions
Which systems are exposed to this crash condition?
The issue affects the Linux kernel powerpc kexec_file path on platforms that have no reserved memory regions. In that case, get_reserved_memory_ranges() may return zero while leaving the rmem pointer NULL.
What triggers the failure?
The failure occurs when kexec_extra_fdt_size_ppc64() evaluates rmem->nr_ranges after rmem was left NULL. This results in a kernel panic from a NULL pointer dereference.
How can I determine whether a system is affected?
A system is in the affected condition if it uses the powerpc kexec_file path and has no reserved memory regions, causing get_reserved_memory_ranges() to return zero without allocating rmem. The described symptom is a kernel panic while calculating the extra FDT size.
What mitigation is available if the fix cannot be applied immediately?
The provided information identifies the vulnerable condition as use of the powerpc kexec_file path on a platform without reserved memory regions. Avoiding that path under those conditions prevents the described NULL dereference; the resolved fix adds a NULL check for rmem.