CVE-2026-89568

In the Linux kernel, the following vulnerability has been resolved:

kho: fix size calculation in kho preserved memory reserve()

kho preserved memory reserve() calculates the size of a preservation by doing 1 << (order + PAGE SHIFT). Since the '1' is a 32-bit integer, it can only be shifted by 31. That is, it will only work for preservations up to 2 GiB. Larger preservations will trigger undefined behaviour.

While preservations larger than 2 GiB can't be obtained via folios currently, they can be obtained via kho preserve pages().

For example, memblock reserve mem uses kho preserve pages(). Reservations larger than 2 GiB are valid and will trigger this bug if properly aligned.

Fix it by using 1UL for shifting.