CVE-2026-89961 (GCVE-0-2026-89961)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-19 08:55
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population vmemmap_populate_compound_pages() uses addr_pfn to determine the PFN offset within a compound page and to decide whether the current vmemmap slot should be populated as a head page mapping or should reuse a tail page mapping. However, addr_pfn is advanced manually in parallel with addr. The loop itself progresses in vmemmap address space, so each PAGE_SIZE step in addr covers PAGE_SIZE / sizeof(struct page) struct page slots. Since addr_pfn is compared against nr_pages in data-PFN units, it should advance by the same number of PFNs. The existing manual increments do not match that and therefore do not reliably track the PFN corresponding to the current addr. As a result, pfn_offset can be computed from the wrong PFN and the code can make the head/tail decision for the wrong compound-page position. Fix this by deriving addr_pfn directly from the current vmemmap address instead of carrying it as loop state.
References
Impacted products
Vendor Product Version
Linux Linux Version: f2b79c0d79683d552369bb9a7282c1f0226fc566
Version: f2b79c0d79683d552369bb9a7282c1f0226fc566
Version: f2b79c0d79683d552369bb9a7282c1f0226fc566
Version: f2b79c0d79683d552369bb9a7282c1f0226fc566
Version: f2b79c0d79683d552369bb9a7282c1f0226fc566
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/mm/book3s64/radix_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b96be860673f9fbbf12cdadb0b25fc4d6d4d207f",
              "status": "affected",
              "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
              "versionType": "git"
            },
            {
              "lessThan": "e163c7184acf36ac20a248498f4a16016057ca01",
              "status": "affected",
              "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
              "versionType": "git"
            },
            {
              "lessThan": "9c914b7a0bd18834505c65f22225ce22c152b2d9",
              "status": "affected",
              "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
              "versionType": "git"
            },
            {
              "lessThan": "7968852a7ca3ce81477ec5b4494a28d612f35a97",
              "status": "affected",
              "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
              "versionType": "git"
            },
            {
              "lessThan": "89a4ae32764172468dea303eb6ae90fe6c859712",
              "status": "affected",
              "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/mm/book3s64/radix_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population\n\nvmemmap_populate_compound_pages() uses addr_pfn to determine the PFN\noffset within a compound page and to decide whether the current vmemmap\nslot should be populated as a head page mapping or should reuse a tail\npage mapping.\n\nHowever, addr_pfn is advanced manually in parallel with addr.  The loop\nitself progresses in vmemmap address space, so each PAGE_SIZE step in addr\ncovers PAGE_SIZE / sizeof(struct page) struct page slots.  Since addr_pfn\nis compared against nr_pages in data-PFN units, it should advance by the\nsame number of PFNs.  The existing manual increments do not match that and\ntherefore do not reliably track the PFN corresponding to the current addr.\n\nAs a result, pfn_offset can be computed from the wrong PFN and the code\ncan make the head/tail decision for the wrong compound-page position.\n\nFix this by deriving addr_pfn directly from the current vmemmap address\ninstead of carrying it as loop state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in powerpc radix vmemmap_populate_compound_pages(), reached only through local ZONE_DEVICE hotplug (dev_dax_probe \u2192 devm_memremap_pages \u2192 arch_add_memory \u2192 sparse_add_section). It is not reachable from network protocols, Bluetooth, or USB.\nAC:L - Once device-DAX with compound vmemmap is mapped (2MB PMD on 4K kernels or 1GB PUD on 64K, the documented powerpc DAX configs), addr_pfn drifts on every loop iteration and the wrong head/tail mapping is deterministic; no race or attacker-uncontrollable layout is required.\nPR:L - Initial memremap requires administrator DAX setup, but on a provisioned persistent-memory or cloud POWER server an unprivileged local user with /dev/dax access can mmap the device and drive kernel use of the mis-aliased struct pages via faults and GUP without init-namespace CAP_SYS_ADMIN.\nUI:N - Exploitation needs no victim action; the attacker mmaps or faults the already-provisioned DAX device themselves. No mount, click, or hotplug by another user is required at exploit time.\nS:U - Impact is kernel struct-page aliasing and MM corruption inside the same host kernel security authority. It is not a KVM guest-to-host escape, IOMMU/DMA bypass, or sandbox boundary crossing.\nC:H - Wrong pfn_offset aliases distinct vmemmap pages so different DAX PFNs share struct-page backing; later memmap_init, faults, and GUP read corrupted flags, mapping, and compound-head fields, disclosing kernel memory via that metadata.\nI:H - The same aliases turn kernel writes (page init, folio mapping, refcount, compound head/tail linkage) into writes to the wrong struct pages, an exploitable kernel memory-corruption primitive that can hijack control flow rather than a bounded data modification.\nA:H - Mis-linked compound pages and aliased vmemmap cause kernel oops, BUG_ON, or panic when MM code walks folio heads, refcounts, or DAX fault handlers, fully denying availability of the affected POWER radix host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:55:35.034Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b96be860673f9fbbf12cdadb0b25fc4d6d4d207f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e163c7184acf36ac20a248498f4a16016057ca01"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c914b7a0bd18834505c65f22225ce22c152b2d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7968852a7ca3ce81477ec5b4494a28d612f35a97"
        },
        {
          "url": "https://git.kernel.org/stable/c/89a4ae32764172468dea303eb6ae90fe6c859712"
        }
      ],
      "title": "powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89961",
    "datePublished": "2026-09-16T10:32:43.921Z",
    "dateReserved": "2026-09-11T19:38:34.778Z",
    "dateUpdated": "2026-10-19T08:55:35.034Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.