Skip to main content

Linux KVM s390 EUVDEUVD-2026-80520

| CVE-2026-89920 HIGH
2026-09-16 Linux GHSA-vhrh-h65f-3j9h
Buffer Overflow Linux Red Hat
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Have local/guest context on s390 KVM host
  2. Delivery
    Channel-subsystem damage (CK) machine check occurs
  3. Exploit
    Host kernel reinjects CK check toward guest
  4. Execution
    Reinjection path kfree()s a stack variable
  5. Impact
    Host kernel memory corruption / DoS

Vulnerability Assessment

Exploitation Conditions

Requires an s390 (IBM Z mainframe) host running the Linux kernel KVM hypervisor with guests. Exploitation is gated on the occurrence of a channel-subsystem damage machine check with the CK bit set - a hardware/host error condition that is not directly attacker-controllable, which is why AC:H applies. Limiting factors: local vector only (AV:L), attacker needs some existing privilege/guest execution context (PR:L), the affected code exists only on the s390 architecture, and the machine-check trigger cannot be summoned on demand, so reliable exploitation is impractical.
Impact

This is a Linux kernel KVM/s390 host-side memory-corruption bug (an invalid kfree of a stack variable) triggered while reinjecting channel-subsystem-damage (CK) machine checks into a guest. The vendor CVSS 7.8 vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H is internally inconsistent (that vector computes ~8.2, not 7.8) and, more importantly, over-scores impact. AC:H is justified because the trigger is a genuine channel-subsystem damage machine check - a rare host hardware error condition, NOT something an attacker can reliably generate at will. There is no EPSS score, no CISA KEV listing, and no public POC, so exploitation signals are all absent: no public exploit identified at time of analysis. The corruption is a stray free of a non-heap pointer, which is realistically a crash/DoS primitive rather than a clean confidentiality/integrity compromise, so the C:H/I:H rating is generous. Net: this is a real correctness/reliability fix worth patching on affected s390 hosts, but it is a low real-world-priority item, not a widespread or readily weaponizable threat.
Exploit ScenarioDerived

On an IBM Z (s390) host running KVM guests, a channel-subsystem damage machine check occurs and the host kernel erroneously reinjects it toward the guest, hitting a code path that frees a stack-allocated variable and corrupts host kernel memory, most likely crashing the host. Because the CK machine check is a hardware event the attacker cannot reliably summon, practical exploitation is opportunistic rather than deterministic. No public exploit code exists.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 16, 2026

Memory corruption on IBM Z (s390) KVM hosts running the Linux kernel is triggered when a channel-subsystem damage machine check (the CK bit) is reinjected into a guest, causing the host kernel to kfree() a stack variable. Exploitation requires an authenticated local actor with existing privileges on an s390 host that runs KVM guests (CVSS AV:L/PR:L) and depends on a hardware/host error condition that cannot be summoned on demand, which is reflected in the assessed AC:H and a scope-changed impact profile of low integrity and high availability impact rather than full host compromise. Vendor-released patches exist (stable 6.18.51, 7.2.5 and 7.3-rc1/mainline commits); no public exploit code and no confirmed active exploitation were identified at time of analysis.

RemediationAI

Apply the vendor fix: upgrade to Linux 6.18.51, 7.2.5 or 7.3-rc1 (or later) where those releases are available, or cherry-pick the upstream fix commit 546dde823a36d7283dcf46127c2f3d093443860f, with the stable backports 7077ec953996acc04b49d1dfc43df1c1a2a74395 and 6ee52d3af2a1bf70349cf3f860933c8d221e229a, as published at https://git.kernel.org/stable/c/6ee52d3af2a1bf70349cf3f860933c8d221e229a, https://git.kernel.org/stable/c/7077ec953996acc04b49d1dfc43df1c1a2a74395 and https://git.kernel.org/stable/c/546dde823a36d7283dcf46127c2f3d093443860f (see also https://nvd.nist.gov/vuln/detail/CVE-2026-89920). Until patched, reduce exposure by treating the s390 KVM host as a privileged boundary: restrict who can create or run KVM guests so that only trusted administrators hold the PR:L-level access the flaw requires, and avoid running untrusted or multi-tenant guests on unpatched s390 hypervisors - the trade-off is loss of guest-hosting capability or increased operational controls. Because the bug is only reachable when a CK channel-subsystem damage machine check is processed for reinjection, hosts that do not run KVM guests on s390 do not exercise the vulnerable path, though disabling guest hosting eliminates the hypervisor's intended function. Monitoring host dmesg/syslog for machine-check reports and 'kfree'/'bad address' or slab-corruption warnings can give early warning, but detection is reactive and does not prevent the corruption itself; there is no configuration knob in the provided data that disables only the CK reinjection behavior.

Affected VersionsENISA

Linux patch: 7.2.5
Linux patch: 7.3-rc1
Linux 4.13
Linux 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 <546dde823a36d7283dcf46127c2f3d093443860f
Linux patch: 0
Linux patch: 6.18.51
Linux 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 <7077ec953996acc04b49d1dfc43df1c1a2a74395
Linux 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 <6ee52d3af2a1bf70349cf3f860933c8d221e229a

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

On s390 (IBM Z), the channel subsystem is abstracted by machine checks that carry bit flags describing the fault type; the CK bit identifies channel-subsystem damage, which pertains to the physical host channel subsystem. Under KVM, the guest-visible channel subsystem is emulated in userspace (QEMU), so reinjecting a host channel-subsystem damage machine check into a guest is meaningless - the original code nonetheless queued it for reinjection, and the erroneous path performed kfree() on a stack variable, corrupting host kernel memory. The fix stops reinjecting CK machine checks into guests, simplifies the machine-check reinjection logic, and additionally masks the CK bit in s390_backup_mcck_info() the same way the CP and ED bits are already masked, so that combined machine-check conditions (e.g. CK together with instruction damage) are handled safely. No CWE was assigned by the source; the flaw class is a free of memory that was not allocated on the heap (CWE-590-style invalid free), observable here as host-side memory corruption. The affected code is architecture-specific to s390 KVM and was identified during code review (credited to the sashiko review tooling), and the only CPE supplied is the generic linux:linux kernel product.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI 6.4 MEDIUM

Local s390-only trigger dependent on an uncontrollable hardware machine check (AV:L/AC:H/PR:L); stray free corrupts host memory across the guest/host boundary (S:C) but is DoS-dominant, so A:H with minimal C/I.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H
SUSE 4.7 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
Red Hat 4.7 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 16, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Sep 16, 2026 - 11:03 EUVD
CVE Published
Sep 16, 2026 - 10:32 cve.org
HIGH 7.8
CVE Published
Sep 16, 2026 - 10:32 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Fix memory corruption by not reinjecting CK machine checks

Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in forwarding such machine checks into the guest.

This also simplifies the machine check reinjection and avoids kfree of a stack variable as reported by sashiko. There might be still machine checks that have the ck bit set with another bit (like instruction damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and ED bits already are.

Executive ViewAI

Why It Matters

IBM Z (s390) KVM hosts running the Linux kernel are affected by a memory corruption vulnerability that can cause host availability disruptions. Organizations using these hosts for virtualized workloads face potential downtime for all guests on an affected host, though exploitation requires an authenticated local attacker and a specific hardware error condition that cannot be triggered on demand. No public exploit identified at time of analysis.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Low
Linux kernel is ubiquitous but this code path runs only on s390/IBM Z KVM hosts
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-89920 ADVISORY https://ubuntu.com/security/notices/USN-8959-1 ADVISORY https://ubuntu.com/security/notices/USN-8960-1 REF https://git.kernel.org/stable/c/045f3e95a0deccb277c29bd003e1d43c0ad40c90 REF https://git.kernel.org/stable/c/546dde823a36d7283dcf46127c2f3d093443860f REF https://git.kernel.org/stable/c/5c63e2ed840c85e27172ab78e7db3ac77fba281b REF https://git.kernel.org/stable/c/6ee52d3af2a1bf70349cf3f860933c8d221e229a REF https://git.kernel.org/stable/c/7077ec953996acc04b49d1dfc43df1c1a2a74395 REF https://git.kernel.org/stable/c/b7631982fb65dd355acd18e62b384bc8125e9c44

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy