CVE-2026-89963: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89963 Overview

CVE-2026-89963 is a NULL pointer dereference vulnerability in the Linux kernel's PowerPC kexec_file implementation. The flaw resides in the kexec_extra_fdt_size_ppc64() function, which calculates additional flattened device tree (FDT) size for kexec operations. On PowerPC platforms without reserved memory regions, get_reserved_memory_ranges() returns 0 while leaving the rmem pointer unallocated as NULL. The function then dereferences rmem->nr_ranges, triggering a kernel panic. Upstream maintainers have resolved the issue by adding a NULL check before dereferencing rmem.

Critical Impact
Local triggering of the kexec code path on affected PowerPC systems without reserved memory regions results in a kernel panic and denial of service.

Affected Products

Linux kernel (PowerPC / ppc64 architecture)
Kernel kexec_file subsystem
Systems invoking kexec_extra_fdt_size_ppc64() on platforms lacking reserved memory ranges

Discovery Timeline

2026-09-16 - CVE-2026-89963 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89963

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the PowerPC kexec file loader. The kexec_extra_fdt_size_ppc64() function computes the extra size required for the flattened device tree when preparing a kexec image on ppc64 systems. It relies on get_reserved_memory_ranges() to populate an rmem structure describing reserved memory regions.

When the underlying platform reports no reserved memory regions, get_reserved_memory_ranges() returns 0 as a success indicator but does not allocate the rmem buffer. The caller does not validate this condition and immediately accesses rmem->nr_ranges. Dereferencing the unallocated pointer causes an oops and a kernel panic.

Root Cause

The root cause is a missing NULL check on the return path of get_reserved_memory_ranges(). The helper communicates "no regions found" by returning 0 with a NULL output pointer, but the calling code treats the zero return value as an unconditional signal that rmem is valid. Any PowerPC platform without any populated reserved memory ranges reaches the vulnerable dereference.

Attack Vector

Exploitation requires local access and the ability to invoke the kexec_file_load system call, which is normally restricted to privileged users. On affected ppc64 platforms, triggering the kexec image preparation path causes an immediate kernel panic, resulting in denial of service. There is no evidence of remote exploitation or code execution primitives associated with this flaw.

No public proof-of-concept code is available. Technical details for the fix are documented in the upstream commits referenced by the Kernel Git Commit Change.

Detection Methods for CVE-2026-89963

Indicators of Compromise

Unexpected kernel oops or panic messages referencing kexec_extra_fdt_size_ppc64 in dmesg or serial console output on PowerPC hosts.
Unscheduled reboots on ppc64 systems following invocation of kexec_file_load().
Crash dumps whose backtrace includes get_reserved_memory_ranges and a NULL pointer fault address.

Detection Strategies

Inventory Linux hosts running PowerPC kernels and compare their kernel versions against the fixed commits listed in the upstream references.
Monitor kernel logs for panic signatures involving the kexec_file code path.
Audit which users and processes hold CAP_SYS_BOOT, since that capability is required to reach the vulnerable code.

Monitoring Recommendations

Forward kern.log, journald, and serial console output from PowerPC hosts into a centralized logging or SIEM pipeline for panic-signature alerting.
Alert on repeated kexec_file_load syscall invocations from non-administrative processes via auditd rules.
Track kernel version drift across the PowerPC fleet to confirm patch adoption.

How to Mitigate CVE-2026-89963

Immediate Actions Required

Identify all PowerPC (ppc64) hosts and prioritize kernel updates to versions that include the upstream fix.
Restrict CAP_SYS_BOOT to a minimal set of administrative accounts to limit who can invoke kexec_file_load().
Verify crash and reboot handling on affected hosts to detect denial-of-service attempts triggered by the vulnerable path.

Patch Information

The issue is resolved by adding a NULL check for rmem in kexec_extra_fdt_size_ppc64() before accessing rmem->nr_ranges. Fixes are available in the following upstream commits: 11ef1c2a5dbe, 4ff3d9fd71c7, 761eda315a6e, and df45337587db. Apply the vendor-provided stable kernel package that incorporates these commits.

Workarounds

Where patching is not immediately feasible, disable or restrict access to the kexec_file_load syscall using seccomp or Linux Security Module policies on PowerPC hosts.
Remove CAP_SYS_BOOT from non-essential service accounts and containers to prevent unprivileged triggering of the kexec path.
Avoid running kexec-based kernel loading workflows on affected ppc64 platforms until patched kernels are deployed.

bash

# Configuration example: identify PowerPC hosts and kernel versions for patch planning
uname -m   # expect: ppc64 or ppc64le on affected systems
uname -r   # compare against fixed stable kernel versions

# Restrict kexec_file_load via auditd for monitoring
echo '-a always,exit -F arch=b64 -S kexec_file_load -k cve_2026_89963' \
  | sudo tee /etc/audit/rules.d/cve-2026-89963.rules
sudo augenrules --load