CVE-2026-89962 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
powerpc/kexec_file: Prevent kexec range truncation
Sashiko AI review pointed out the following issue.
The __merge_memory_ranges() function incorrectly handles overlapping memory ranges when merging them. Although sort_memory_ranges() sorts all ranges by their start address in ascending order beforehand, the merge logic remains defective in two ways:
1. It compares the current range's start against the previous element (i-1) instead of the running target index (idx)
2. It unconditionally overwrites 'ranges[idx].end' with 'ranges[i].end'.
This logic flaw leads to critical memory truncation when a larger memory range completely subsumes subsequent smaller ranges.
For example, consider a sorted input array with three ranges: Range A (idx=0): [0x1000 - 0x9000]
Range B (i=1): [0x2000 - 0x5000] (completely inside Range A)
Range C (i=2): [0x6000 - 0x8000] (completely inside Range A)
1. When i=1 (Range B): ranges[1].start (0x2000) <= ranges[0].end + 1 (0x9001) is TRUE.
The code executes: ranges[0].end = ranges[1].end, which erroneously
shrinks Range A's end from 0x9000 down to 0x5000.
2. When i=2 (Range C): ranges[2].start (0x6000) <= ranges[1].end + 1 (0x5001) is FALSE.
The code falls into the else block, creating a broken new range.
As a result, valid memory fragments [0x5001 - 0x5fff] and [0x8001 - 0x9000]
are completely lost from the kexec exclude lists, potentially allowing the crash kernel to overwrite active memory, causing data corruption or crashes.
Fix this by ensuring the start of the current range is compared against the end of the active merged range (idx), and use max() to safely prevent the outer boundary from being truncated.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel vulnerability identified in the powerpc kexec_file subsystem represents a critical logic error within the memory management routines used during system reboot operations. Specifically, the __merge_memory_ranges function contains defects that lead to incorrect handling of overlapping memory ranges. This flaw was highlighted by Sashiko AI review and stems from two primary implementation errors: first, the algorithm compares the start address of the current range against the end address of the previous element in the sorted array rather than the end address of the active merged range being constructed; second, it unconditionally overwrites the end boundary of the target range with the end boundary of the incoming range. These issues result in a failure to properly consolidate contiguous or overlapping memory regions, which is essential for maintaining accurate exclusion lists during kexec operations.
The operational impact of this vulnerability is severe because it leads to critical memory truncation when a larger memory range completely subsumes subsequent smaller ranges within the sorted input array. For instance, if Range A spans from 0x1000 to 0x9000 and Range B lies entirely within it from 0x2000 to 0x5000, the defective logic incorrectly shrinks Range A's end boundary to 0x5000. This erroneous truncation causes valid memory fragments between 0x5001 and 0x9000 to be lost from the kexec exclude lists. Consequently, these memory regions are no longer protected during the boot process of a new kernel via kexec.
The security implications of this flaw are significant as they allow for potential data corruption or system crashes. By losing valid memory fragments from the exclusion list, the crash kernel may inadvertently overwrite active memory that is still in use by the running system or other critical processes. This violates fundamental principles of memory safety and isolation, potentially leading to privilege escalation if an attacker can manipulate these ranges to target specific sensitive areas, or simply cause a denial of service through system instability. The vulnerability aligns with CWE-602, Client-Side Injection of Critical State Data, in the context that external inputs (memory map data) are processed incorrectly, and CWE-190, Integer Overflow or Wraparound, if arithmetic errors contribute to boundary miscalculations, though it is primarily a logic error akin to CWE-845, Improper Access Control.
To mitigate this vulnerability, developers must ensure that the start of each current range is compared against the end of the active merged range identified by the running index rather than the previous array element. Furthermore, when updating the boundaries of the merged ranges, the code should utilize a maximum function to safely prevent the outer boundary from being truncated incorrectly. This ensures that if an incoming range is contained within an existing one, the larger bounds are preserved. Applying this fix restores the integrity of the memory exclusion lists, ensuring that kexec operations do not compromise system stability or security by overwriting active memory regions.