CVE-2026-89568

What it actually does

Integer shift overflow in kho_preserved_memory_reserve() when computing preservation size via 1 << (order + PAGE_SHIFT) for values >31 bits, causing undefined behavior and potential memory corruption on large reservations obtained through kho_preserve_pages().

Why it matters to the business

Systems performing large memory reservations may experience kernel instability, crashes, or corruption, increasing downtime risk for workloads relying on memblock or similar reservation paths; low immediate threat due to absent known exploitation.

How an attack unfolds

An attacker with local access or control over reservation paths invokes kho_preserve_pages() or equivalent memblock reserve_mem calls with properly aligned sizes exceeding 2 GiB, triggering the 32-bit shift undefined behavior that may corrupt kernel memory structures.

How to fix it

Apply the upstream fix replacing the shift constant with 1UL; rebuild and deploy updated Linux kernel packages containing the corrected kho_preserved_memory_reserve() implementation.

How to confirm the fix worked

Inspect kernel source for use of 1UL in the size calculation; boot test systems with large (>2 GiB) aligned reservations and confirm absence of undefined behavior or crashes; verify via code review or dynamic testing on reservation paths.

Typical attack path

1. Obtain local execution or kernel module loading capability
2. Trigger large aligned memory reservation via kho_preserve_pages() or memblock APIs
3. Cause shift of 32-bit 1 by more than 31 bits leading to undefined behavior
4. Exploit resulting memory corruption for denial of service or privilege escalation

How to detect it

Search kernel logs and dmesg for shift-related warnings, undefined behavior symptoms, or crashes during memory reservation operations; review audit logs for processes invoking large kho_preserve_pages() or memblock calls.

What your security team should do

• Prioritize kernel updates on systems performing large memory reservations once patches are available
• Monitor upstream Linux kernel commits for the 1UL fix and backport to distribution kernels
• Limit use of kho_preserve_pages() for reservations >2 GiB until patched
• Review memblock and kho reservation call sites for size validation