Description
In the Linux kernel, the following vulnerability has been resolved:
kho: fix size calculation in kho_preserved_memory_reserve()
kho_preserved_memory_reserve() calculates the size of a preservation by doing 1 << (order + PAGE_SHIFT). Since the '1' is a 32-bit integer, it can only be shifted by 31. That is, it will only work for preservations up to 2 GiB. Larger preservations will trigger undefined behaviour.
While preservations larger than 2 GiB can't be obtained via folios currently, they can be obtained via kho_preserve_pages().
For example, memblock reserve_mem uses kho_preserve_pages(). Reservations larger than 2 GiB are valid and will trigger this bug if properly aligned.
Fix it by using 1UL for shifting.
Metrics
No CVSS score has been published yet.
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= fc33e4b44b2717feba2f6f07ce7943a96499c9ec, < 0692a8fdf0222af130c8ea97426f1c3bf3814905; >= fc33e4b44b2717feba2f6f07ce7943a96499c9ec, < 42a6f03cf352eb6e6dbeef95e75e686f4cdb9bd1; >= fc33e4b44b2717feba2f6f07ce7943a96499c9ec, < 3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded |
| Linux | Linux | 6.16 |
References
Timeline
- Published
- Sep 11, 2026
- Last modified
- Oct 19, 2026
- NVD status
- Received