Look up another CVE · open CVE-2026-89922 in the interactive tracker
CVE-2026-89922
KVM: s390: Take srcu when importing watchpoint data
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem arch/s390. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89922 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
__import_wp_info() backs up the original guest memory contents of a watchpoint with read_guest_abs(), which is kvm_read_guest() and therefore resolves the memslot via __kvm_memslots(). That requires kvm->srcu (or kvm->slots_lock) to be held, otherwise a concurrent memslot update can free the memslots array under us once its SRCU grace period has elapsed. As this is not fast path, following lock ordering (mutex first, then srcu) take the big hammer and hold the srcu for the full import.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/s390/kvm/kvm-s390.c
- What this is
- KERNEL VIRTUAL MACHINE for s390 (KVM/s390)MAINTAINERS section matched on arch/s390/kvm/ · kvm@vger.kernel.org · Supported
- Kernel module
- kvm
Check it on the machine
grep -w CONFIG_KVM /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w kvmPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormBnot built on arm64/rt/arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
- trixieBnot built on armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
- forky, sidBnot built on armhf/armmp, armhf/armmp-lpae
- bookworm · linux-6.12Bnot built on armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
- B
- built in on some, a module on others, absent on the rest
- Build switch
- CONFIG_KVM
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 5.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- arch/s390
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.16 | 6.1.188 | 6830fbc3724b |
| 3.16 | 6.6.157 | f8e3a9997d5e |
| 3.16 | 6.12.110 | 76f5b4ea9ed0 |
| 3.16 | 6.18.51 | cc710ee45395 |
| 3.16 | 7.2.5 | 4c05bf21d180 |
| 3.16 | 7.3 | a4e482def853 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached only through the local KVM_SET_GUEST_DEBUG vCPU ioctl on a fd from /dev/kvm (kvm_vcpu_ioctl -> kvm_arch_vcpu_ioctl_set_guest_debug -> kvm_s390_import_bp_data). No network, adjacent-radio, or physical-device path reaches this s390 watchpoint import.
- AC:LAttack complexity, low
- The attacker controls both sides of the race: one thread issues KVM_SET_GUEST_DEBUG with KVM_GUESTDBG_USE_HW_BP while another mutates memslots via KVM_SET_USER_MEMORY_REGION on the VM fd. Guest PER (sclp.has_gpere) is standard on s390 KVM hosts, not a rare config the attacker cannot influence.
- PR:LPrivileges required, low
- The ioctl path has no capability check; only s390 ucontrol VMs require CAP_SYS_ADMIN. An unprivileged user with /dev/kvm access (kvm group or mode 0666, typical on virtualization hosts) can create a VM/vCPU and trigger the import.
- UI:NUser interaction, none
- The attacking process creates the VM and vCPU, installs hardware watchpoints, and races memslot updates itself. No separate victim user action such as mounting a filesystem or opening a file is required.
- S:UScope, unchanged
- KVM_SET_GUEST_DEBUG is a host-userspace ioctl; a guest cannot issue it, and this is not a guest-to-host escape. Impact stays within the host kernel's security authority, matching other KVM ioctl missing-SRCU UAFs.
- C:HConfidentiality impact, high
- Without SRCU, read_guest_abs()/kvm_read_guest() resolves memslots via __kvm_memslots() while a concurrent update can kfree the kvm_memory_slot after the SRCU grace period. Use-after-free of slot metadata and gfn-tree nodes enables kernel-heap disclosure and is scored High.
- I:HIntegrity impact, high
- The same UAF lets the attacker reclaim the freed kvm_memory_slot, plant a dangling last_used_slot pointer, and walk attacker-controlled rb_left/rb_right during search_memslots(), yielding a kernel write/control-flow primitive. Kernel UAF memory corruption is scored High integrity.
- A:HAvailability impact, high
- Dereferencing a freed kvm_memory_slot or walking a concurrently destroyed gfn rbtree causes a host kernel oops or panic. The unprotected srcu_dereference_check() also trips lockdep, which is fatal under panic_on_warn.