EUVD-2026-80520
GHSA-vhrh-h65f-3j9h
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Local s390-only trigger dependent on an uncontrollable hardware machine check (AV:L/AC:H/PR:L); stray free corrupts host memory across the guest/host boundary (S:C) but is DoS-dominant, so A:H with minimal C/I.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix memory corruption by not reinjecting CK machine checks
Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in forwarding such machine checks into the guest.
This also simplifies the machine check reinjection and avoids kfree of a stack variable as reported by sashiko. There might be still machine checks that have the ck bit set with another bit (like instruction damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and ED bits already are.
AnalysisAI
Memory corruption on IBM Z (s390) KVM hosts running the Linux kernel is triggered when a channel-subsystem damage machine check (the CK bit) is reinjected into a guest, causing the host kernel to kfree() a stack variable. Exploitation requires an authenticated local actor with existing privileges on an s390 host that runs KVM guests (CVSS AV:L/PR:L) and depends on a hardware/host error condition that cannot be summoned on demand, which is reflected in the assessed AC:H and a scope-changed impact profile of low integrity and high availability impact rather than full host compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an s390 (IBM Z mainframe) host running the Linux kernel KVM hypervisor with guests. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a Linux kernel KVM/s390 host-side memory-corruption bug (an invalid kfree of a stack variable) triggered while reinjecting channel-subsystem-damage (CK) machine checks into a guest. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix: upgrade to Linux 6.18.51, 7.2.5 or 7.3-rc1 (or later) where those releases are available, or cherry-pick the upstream fix commit 546dde823a36d7283dcf46127c2f3d093443860f, with the stable backports 7077ec953996acc04b49d1dfc43df1c1a2a74395 and 6ee52d3af2a1bf70349cf3f860933c8d221e229a, as published at https://git.kernel.org/stable/c/6ee52d3af2a1bf70349cf3f860933c8d221e229a, https://git.kernel.org/stable/c/7077ec953996acc04b49d1dfc43df1c1a2a74395 and https://git.kernel.org/stable/c/546dde823a36d7283dcf46127c2f3d093443860f (see also https://nvd.nist.gov/vuln/detail/CVE-2026-89920). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Z (s390) KVM hosts running Linux kernel versions prior to 6.18.51 or 7.2.5, and apply the vendor-released patch (stable 6.18.51 or 7.2.5, or mainline 7.3-rc1) or schedule emergency maintenance; in the interim, restrict local access to trusted administrators and monitor host logs for crashes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today