EUVD-2026-80522
GHSA-x4qh-jwqp-j7jf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local s390 KVM VMM/guest-control path (AV:L, PR:L); timing-dependent memslot race (AC:H); UAF is DoS-dominant (A:H) with only incidental memory-content exposure (C:L/I:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Take srcu when importing watchpoint data
__import_wp_info() backs up the original guest memory contents of a watchpoint with read_guest_abs(), which is kvm_read_guest() and therefore resolves the memslot via __kvm_memslots(). That requires kvm->srcu (or kvm->slots_lock) to be held, otherwise a concurrent memslot update can free the memslots array under us once its SRCU grace period has elapsed.
As this is not fast path, following lock ordering (mutex first, then srcu) take the big hammer and hold the srcu for the full import.
AnalysisAI
A use-after-free race condition in the Linux kernel's s390 KVM guest-debug watchpoint code lets a local user who can control an IBM Z guest VM read or corrupt freed kernel memory. When a hardware watchpoint is imported via the KVM_SET_GUEST_DEBUG path, __import_wp_info() backs up guest memory with read_guest_abs() without holding kvm->srcu, so a concurrent memslot update can free the memslots array mid-read. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access on an s390/IBM Z host running KVM, plus the ability to drive a guest's debug facility: __import_wp_info() is reached when a hardware watchpoint is imported (KVM_SET_GUEST_DEBUG guest-debug path). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a locally-triggered race condition (CWE-362) in the s390 KVM guest-debug watchpoint code: __import_wp_info() reads original guest memory via read_guest_abs()/kvm_read_guest(), which resolves the memslot through __kvm_memslots() without holding kvm->srcu or slots_lock, so a concurrent memslot update can free the memslots array under the reader (a use-after-free). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to a fixed Linux kernel build - 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 or 7.3-rc1 - or cherry-pick the upstream fix commits 6830fbc3724bf49c142aae69a4694f115fa9cedd, f8e3a9997d5ecd56ebe4b262ff424516c068fecb, 76f5b4ea9ed0aa5a34bda9d8a878f2c73026ec03, cc710ee45395efb4937e042960f791d33924e5f6, 4c05bf21d1806853e662cc19e744736a3408f155 or a4e482def8533ebace517d9f67f1465841b1f982 from git.kernel.org/stable (see also the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-89922); patches are also available from the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Z (s390x) systems running KVM and apply the vendor-released kernel patch as specified in your Linux distribution's security advisory for CVE-2026-89922 (e.g., update to the latest kernel version provided by Red Hat, SUSE, or Ubuntu). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary host file exfiltration from Cloud Hypervisor VMM versions 34.0-50.0. CVSS 10.0. Patch available.
Incorrect handling of queued local TLB flushes in the Linux kernel's KVM nested-VMX (nVMX) implementation can leave stal
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed f
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations fo
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range
A use-after-free (CWE-416) in the Linux kernel's s390/vfio-ap AP crypto passthrough driver allows a local attacker with
The s390 vfio-ap mediated device (mdev) driver in the Linux kernel fails to actually revoke crypto control-domain access
Stale hardware access to unplugged crypto resources in Linux KVM guests on IBM Z (s390) stems from a logic error in the
Stale TLB entries can be reused by an L2 guest in the Linux kernel's KVM nested virtualization (nVMX) implementation on
Linux kernel's KVM nested-VMX (nVMX) emulation can leave stale L2 guest TLB entries on a physical CPU, because KVM execu
Slab use-after-free in the Linux kernel's KVM x86 MMU lockless rmap aging path affects hosts running Linux 6.15 through
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today