Linux Kernel EUVD-2026-80522

Requires local access on an s390/IBM Z host running KVM, plus the ability to drive a guest's debug facility: __import_wp_info() is reached when a hardware watchpoint is imported (KVM_SET_GUEST_DEBUG guest-debug path). Exploitation additionally requires a concurrent memslot update (e.g., guest memory hot-plug/region change from the VMM) to occur within the SRCU grace window so the memslots array is freed while being read. Limiting factors: it is an s390-only code path, needs privileges to control the VM/VMM (PR:L, not remote), is non-default in that it depends on watchpoint use, and is timing-dependent - the attacker must win a narrow race, so reliable triggering is hard. Not remotely reachable.

This is a locally-triggered race condition (CWE-362) in the s390 KVM guest-debug watchpoint code: __import_wp_info() reads original guest memory via read_guest_abs()/kvm_read_guest(), which resolves the memslot through __kvm_memslots() without holding kvm->srcu or slots_lock, so a concurrent memslot update can free the memslots array under the reader (a use-after-free). The vendor CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but several signals argue for a lower real-world priority. There is no EPSS score, no CISA KEV listing, and no public exploit - exploitation is not known to be occurring. The vector's AC:L understates the difficulty: this is a race that requires winning a narrow window between a watchpoint import and a concurrent memslot update, which realistically warrants AC:H. The impact is DoS-dominant (host crash / memory corruption on UAF); the vendor's C:H/I:H is overstated, since the primary observable effect is a freed-memslots dereference rather than reliable data disclosure or controlled write. Note the metadata conflict: the CVE is tagged 'Information Disclosure' yet the mechanism and impact are a memory-corruption/DoS race - treat the tag as loosely defensible (a stale memslots read could leak) but not the dominant risk. Overall: a genuine correctness bug worth patching on s390 KVM hosts, but not a high-urgency, mass-exploitation threat.

On an IBM Z / s390 KVM host, a local user or process with rights to drive a guest VM (e.g., the VMM/QEMU issuing KVM_SET_GUEST_DEBUG to install a hardware watchpoint) triggers __import_wp_info() while concurrently forcing a memslot update. Winning the race frees the memslots array during the guest-memory backup read, causing a use-after-free that crashes the host or corrupts kernel memory. No public exploit code is identified at time of analysis, and the timing-dependent nature makes reliable exploitation difficult.