UBUNTU-CVE-2026-89961: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: fix wrong addrpfn tracking in compound vmemmap population vmemmappopulatecompoundpages() uses addrpfn to determine the PFN offset within a compound page and to decide whether the current vmemmap slot should be populated as a head page mapping or should reuse a tail page mapping. However, addrpfn is advanced manually in parallel with addr. The loop itself progresses in vmemmap address space, so each PAGESIZE step in addr covers PAGESIZE / sizeof(struct page) struct page slots. Since addrpfn is compared against nrpages in data-PFN units, it should advance by the same number of PFNs. The existing manual increments do not match that and therefore do not reliably track the PFN corresponding to the current addr. As a result, pfnoffset can be computed from the wrong PFN and the code can make the head/tail decision for the wrong compound-page position. Fix this by deriving addrpfn directly from the current vmemmap address instead of carrying it as loop state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Modify vmemmap_populate_compound_pages() to derive addr_pfn directly from the current vmemmap address instead of carrying it as loop state, so each PAGE_SIZE step in addr advances across PAGE_SIZE / sizeof(struct page) struct page slots.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The affected packages listed are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
What level of access does an attacker need?
The vector indicates local access, low attack complexity, and low privileges required. No user interaction is required.
What is the potential impact if exploited?
The severity vector rates confidentiality, integrity, and availability impact as high. The reported issue can cause incorrect PFN-offset calculations and incorrect head-versus-tail compound-page mapping decisions during vmemmap population.