CVE-2026-89962: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89962 is a privilege escalation vulnerability in the Linux kernel that causes memory range truncation during kexec operations, potentially allowing crash kernels to overwrite active memory. This article covers technical details, affected versions, impact analysis, and mitigation strategies.

CVE-2026-89962 Overview

CVE-2026-89962 is a logic flaw in the Linux kernel's powerpc/kexec_file subsystem. The __merge_memory_ranges() function incorrectly handles overlapping memory ranges during merging. When a larger memory range fully subsumes subsequent smaller ranges, the merge logic truncates the outer boundary and drops valid memory fragments from the kexec exclude lists. The crash kernel can then overwrite active memory, causing data corruption or system crashes. The issue affects PowerPC systems that use kexec_file to load crash or replacement kernels.

Critical Impact
Truncated kexec exclude ranges can allow a crash kernel to overwrite active memory regions on PowerPC systems, leading to data corruption or kernel crashes during kexec operations.

Affected Products

Linux kernel powerpc/kexec_file subsystem
PowerPC-based systems using kexec_file_load()
Distributions shipping vulnerable stable kernel branches prior to the fix commits

Discovery Timeline

2026-09-16 - CVE-2026-89962 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89962

Vulnerability Analysis

The defect lives in __merge_memory_ranges() inside the PowerPC kexec_file code path. sort_memory_ranges() orders all ranges by ascending start address before merging, but the merge routine contains two logic errors. It compares the current range's start against the previous array element at index i-1 instead of the running target index idx. It also unconditionally overwrites ranges[idx].end with ranges[i].end instead of retaining the larger boundary.

When a larger range fully contains smaller subsequent ranges, the outer boundary is silently shrunk. Memory fragments that should remain excluded from kexec placement are dropped, and later comparisons operate against a corrupted running end. The exclude list no longer reflects the true reserved regions, and the kexec image loader can place the crash kernel over memory that is still in use.

Root Cause

The root cause is an incorrect merge invariant [CWE-682]. The code assumes each new range extends the previous one linearly, but sorted-by-start ordering does not guarantee sorted-by-end ordering. The fix compares the current range's start against ranges[idx].end and uses max() to preserve the outer boundary when a range is fully contained in the active merged range.

Attack Vector

Exploitation requires local privileges sufficient to invoke kexec_file_load(), which is typically restricted to root. The impact is a reliability and integrity issue rather than a remote code execution primitive. A crafted or naturally occurring memory range layout can trigger the truncation, resulting in the crash kernel overwriting active memory regions during a kexec transition. See the upstream fix commits for the corrected merge logic.

The vulnerability manifests in the range-merging function used to build kexec exclude lists. Refer to Kernel Git Commit fa40f9d and the related stable backports for the corrected implementation.

Detection Methods for CVE-2026-89962

Indicators of Compromise

Unexpected kernel panics or memory corruption during or immediately after kexec_file_load() operations on PowerPC hosts.
Crash kernel failures where the captured vmcore is truncated, corrupted, or overlaps with live kernel memory regions.
Divergence between /proc/iomem reserved regions and the ranges recorded in the kexec segment list.

Detection Strategies

Inventory PowerPC systems and compare running kernel versions against the fixed commits 9ef6362, c4cb547, da88a2a, and fa40f9d.
Audit systems that invoke kexec_file_load() for crash-dump or live-update workflows and review kernel logs around those events.
Validate that stable kernel branches deployed in production include the backported patches for powerpc/kexec_file.

Monitoring Recommendations

Monitor kernel log streams for kexec load errors, memory range warnings, and unexpected reboots on PowerPC hosts.
Track kernel package versions across the fleet and alert when PowerPC nodes run kernels that predate the fix commits.
Capture and inspect vmcore artifacts for signs of overlap with active kernel memory regions after any kexec-initiated crash.

How to Mitigate CVE-2026-89962

Immediate Actions Required

Apply the upstream fix commits 9ef63622e6ce, c4cb547f26d9, da88a2a2119e, and fa40f9dbdd4a from the stable trees to affected PowerPC kernels.
Update to a distribution kernel that includes the backported powerpc/kexec_file merge fix.
Restrict CAP_SYS_BOOT and access to kexec_file_load() to trusted administrative accounts only.

Patch Information

The fix corrects __merge_memory_ranges() to compare against the running target index idx and to use max() when updating the merged range end. Patches are available in the mainline and stable Linux trees. Reference commits: 9ef6362, c4cb547, da88a2a, and fa40f9d.

Workarounds

Avoid using kexec_file_load() on affected PowerPC kernels until the patch is applied; fall back to the legacy kexec_load() path where operationally acceptable.
Disable automated crash-dump-on-panic (kdump) on PowerPC hosts running unpatched kernels to prevent unsafe crash kernel placement.
Limit exposure by removing CAP_SYS_BOOT from non-administrative service accounts.

bash

# Verify running kernel version and check for kexec_file usage
uname -mrs
grep -i kexec /var/log/kern.log
# Temporarily disable kdump service on unpatched PowerPC hosts
systemctl disable --now kdump.service