CVE-2026-89961 (GCVE-0-2026-89961)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:32 – Updated: 2026-09-16 14:40
VLAI
Title
powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population vmemmap_populate_compound_pages() uses addr_pfn to determine the PFN offset within a compound page and to decide whether the current vmemmap slot should be populated as a head page mapping or should reuse a tail page mapping. However, addr_pfn is advanced manually in parallel with addr. The loop itself progresses in vmemmap address space, so each PAGE_SIZE step in addr covers PAGE_SIZE / sizeof(struct page) struct page slots. Since addr_pfn is compared against nr_pages in data-PFN units, it should advance by the same number of PFNs. The existing manual increments do not match that and therefore do not reliably track the PFN corresponding to the current addr. As a result, pfn_offset can be computed from the wrong PFN and the code can make the head/tail decision for the wrong compound-page position. Fix this by deriving addr_pfn directly from the current vmemmap address instead of carrying it as loop state.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f2b79c0d79683d552369bb9a7282c1f0226fc566 , < b96be860673f9fbbf12cdadb0b25fc4d6d4d207f (git)
Affected: f2b79c0d79683d552369bb9a7282c1f0226fc566 , < e163c7184acf36ac20a248498f4a16016057ca01 (git)
Affected: f2b79c0d79683d552369bb9a7282c1f0226fc566 , < 9c914b7a0bd18834505c65f22225ce22c152b2d9 (git)
Affected: f2b79c0d79683d552369bb9a7282c1f0226fc566 , < 7968852a7ca3ce81477ec5b4494a28d612f35a97 (git)
Affected: f2b79c0d79683d552369bb9a7282c1f0226fc566 , < 89a4ae32764172468dea303eb6ae90fe6c859712 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/mm/book3s64/radix_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b96be860673f9fbbf12cdadb0b25fc4d6d4d207f",
              "status": "affected",
              "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
              "versionType": "git"
            },
            {
              "lessThan": "e163c7184acf36ac20a248498f4a16016057ca01",
              "status": "affected",
              "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
              "versionType": "git"
            },
            {
              "lessThan": "9c914b7a0bd18834505c65f22225ce22c152b2d9",
              "status": "affected",
              "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
              "versionType": "git"
            },
            {
              "lessThan": "7968852a7ca3ce81477ec5b4494a28d612f35a97",
              "status": "affected",
              "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
              "versionType": "git"
            },
            {
              "lessThan": "89a4ae32764172468dea303eb6ae90fe6c859712",
              "status": "affected",
              "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/mm/book3s64/radix_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population\n\nvmemmap_populate_compound_pages() uses addr_pfn to determine the PFN\noffset within a compound page and to decide whether the current vmemmap\nslot should be populated as a head page mapping or should reuse a tail\npage mapping.\n\nHowever, addr_pfn is advanced manually in parallel with addr.  The loop\nitself progresses in vmemmap address space, so each PAGE_SIZE step in addr\ncovers PAGE_SIZE / sizeof(struct page) struct page slots.  Since addr_pfn\nis compared against nr_pages in data-PFN units, it should advance by the\nsame number of PFNs.  The existing manual increments do not match that and\ntherefore do not reliably track the PFN corresponding to the current addr.\n\nAs a result, pfn_offset can be computed from the wrong PFN and the code\ncan make the head/tail decision for the wrong compound-page position.\n\nFix this by deriving addr_pfn directly from the current vmemmap address\ninstead of carrying it as loop state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in powerpc radix vmemmap_populate_compound_pages(), reached only through local ZONE_DEVICE hotplug (dev_dax_probe \u2192 devm_memremap_pages \u2192 arch_add_memory \u2192 sparse_add_section). It is not reachable from network protocols, Bluetooth, or USB.\nAC:L - Once device-DAX with compound vmemmap is mapped (2MB PMD on 4K kernels or 1GB PUD on 64K, the documented powerpc DAX configs), addr_pfn drifts on every loop iteration and the wrong head/tail mapping is deterministic; no race or attacker-uncontrollable layout is required.\nPR:L - Initial memremap requires administrator DAX setup, but on a provisioned persistent-memory or cloud POWER server an unprivileged local user with /dev/dax access can mmap the device and drive kernel use of the mis-aliased struct pages via faults and GUP without init-namespace CAP_SYS_ADMIN.\nUI:N - Exploitation needs no victim action; the attacker mmaps or faults the already-provisioned DAX device themselves. No mount, click, or hotplug by another user is required at exploit time.\nS:U - Impact is kernel struct-page aliasing and MM corruption inside the same host kernel security authority. It is not a KVM guest-to-host escape, IOMMU/DMA bypass, or sandbox boundary crossing.\nC:H - Wrong pfn_offset aliases distinct vmemmap pages so different DAX PFNs share struct-page backing; later memmap_init, faults, and GUP read corrupted flags, mapping, and compound-head fields, disclosing kernel memory via that metadata.\nI:H - The same aliases turn kernel writes (page init, folio mapping, refcount, compound head/tail linkage) into writes to the wrong struct pages, an exploitable kernel memory-corruption primitive that can hijack control flow rather than a bounded data modification.\nA:H - Mis-linked compound pages and aliased vmemmap cause kernel oops, BUG_ON, or panic when MM code walks folio heads, refcounts, or DAX fault handlers, fully denying availability of the affected POWER radix host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:40:41.979Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b96be860673f9fbbf12cdadb0b25fc4d6d4d207f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e163c7184acf36ac20a248498f4a16016057ca01"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c914b7a0bd18834505c65f22225ce22c152b2d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7968852a7ca3ce81477ec5b4494a28d612f35a97"
        },
        {
          "url": "https://git.kernel.org/stable/c/89a4ae32764172468dea303eb6ae90fe6c859712"
        }
      ],
      "title": "powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89961",
    "datePublished": "2026-09-16T10:32:43.921Z",
    "dateReserved": "2026-09-11T19:38:34.778Z",
    "dateUpdated": "2026-09-16T14:40:41.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89961",
      "date": "2026-09-25",
      "epss": "0.00175",
      "percentile": "0.06219"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-23T01:51:32.000Z",
      "cve": "CVE-2026-89961",
      "id": "msrc_CVE-2026-89961",
      "initial_release_date": "2026-09-17T01:06:52.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89961.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/powerpc/mm/book3s64/radix_pgtable.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b96be860673f9fbbf12cdadb0b25fc4d6d4d207f",
                    "status": "affected",
                    "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e163c7184acf36ac20a248498f4a16016057ca01",
                    "status": "affected",
                    "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9c914b7a0bd18834505c65f22225ce22c152b2d9",
                    "status": "affected",
                    "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7968852a7ca3ce81477ec5b4494a28d612f35a97",
                    "status": "affected",
                    "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "89a4ae32764172468dea303eb6ae90fe6c859712",
                    "status": "affected",
                    "version": "f2b79c0d79683d552369bb9a7282c1f0226fc566",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/powerpc/mm/book3s64/radix_pgtable.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population\n\nvmemmap_populate_compound_pages() uses addr_pfn to determine the PFN\noffset within a compound page and to decide whether the current vmemmap\nslot should be populated as a head page mapping or should reuse a tail\npage mapping.\n\nHowever, addr_pfn is advanced manually in parallel with addr.  The loop\nitself progresses in vmemmap address space, so each PAGE_SIZE step in addr\ncovers PAGE_SIZE / sizeof(struct page) struct page slots.  Since addr_pfn\nis compared against nr_pages in data-PFN units, it should advance by the\nsame number of PFNs.  The existing manual increments do not match that and\ntherefore do not reliably track the PFN corresponding to the current addr.\n\nAs a result, pfn_offset can be computed from the wrong PFN and the code\ncan make the head/tail decision for the wrong compound-page position.\n\nFix this by deriving addr_pfn directly from the current vmemmap address\ninstead of carrying it as loop state."
          }
        ],
        "id": "CVE-2026-89961",
        "lastModified": "2026-09-16T15:18:20.703",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:17:06.570",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7968852a7ca3ce81477ec5b4494a28d612f35a97"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/89a4ae32764172468dea303eb6ae90fe6c859712"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9c914b7a0bd18834505c65f22225ce22c152b2d9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b96be860673f9fbbf12cdadb0b25fc4d6d4d207f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e163c7184acf36ac20a248498f4a16016057ca01"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:35:45Z",
      "cve": "CVE-2026-89961",
      "id": "CVE-2026-89961",
      "initial_release_date": "2026-09-17T16:33:25Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "318",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89961",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89961.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.