EUVD-2026-80519
GHSA-xrcv-f2mv-23j2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local VM-fd access (AV:L/PR:L); a concurrency race window makes it AC:H; impact is DoS-dominant memory corruption (A:H, I:L) with no demonstrated confidentiality leak (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: keyop: use mmu_lock to read gmap->asce
Every other dat_* consumer in this file (kvm_s390_get_skeys, set_skeys, get_cmma_bits, set_cmma_bits, MEM_CLR_CMMA, kvm_s390_fixup_prefix, kvm_test_age_gfn, kvm_age_gfn) reads kvm->arch.gmap->asce *inside* the mmu_lock read-side. keyop is the only outlier.
gmap->asce is mutated under write_lock(mmu_lock) by gmap_set_limit() and keyop might use a stale asce value for walking as KVM_S390_KEYOP and KVM_S390_VM_MEM_LIMIT_SIZE can run concurrently. This can result in memory corruption.
AnalysisAI
A race condition in the Linux kernel's KVM s390 (IBM Z) keyop path lets a local user who already holds a KVM VM file descriptor cause gmap->asce to be read without the mmu_lock, potentially using a stale address-space-control element and corrupting memory. Exploitation requires s390 hardware, VM-fd access, and issuing KVM_S390_KEYOP concurrently with KVM_S390_VM_MEM_LIMIT_SIZE so that keyop reads asce while gmap_set_limit() mutates it under the write lock; it is timing-dependent, not remotely reachable, and no public exploit has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access on an s390 (IBM Z) host running KVM, plus a KVM VM file descriptor with permission to issue guest ioctls. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a classic high-CVSS-but-lower-real-risk kernel concurrency bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to a kernel containing the fix - stable Linux 7.2.5 or 7.3-rc1 per the EUVD version data - or cherry-pick the upstream stable commits da07a751efa4583385f9f0f47113549fe8871242 and ae452b990e0544425f77045351c56e77158858e7 from https://git.kernel.org/stable/c/da07a751efa4583385f9f0f47113549fe8871242 and https://git.kernel.org/stable/c/ae452b990e0544425f77045351c56e77158858e7, which bring the keyop asce read under mmu_lock like the other dat_* consumers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all s390x/IBM Z hosts running KVM and confirm which kernels they run, restrict interactive shell and VM file-descriptor access on those hosts to the smallest possible set of trusted operators, and enable logging/alerting on KVM_S390_KEYOP and KVM_S390_VM_MEM_LIMIT_SIZE ioctl activity so concurrent or anomalous calls are detectable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today