Vulnerability-Lookup

GHSA-X4QH-JWQP-J7JF

Vulnerability from github – Published: 2026-09-16 12:30 – Updated: 2026-09-16 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Take srcu when importing watchpoint data

__import_wp_info() backs up the original guest memory contents of a watchpoint with read_guest_abs(), which is kvm_read_guest() and therefore resolves the memslot via __kvm_memslots(). That requires kvm->srcu (or kvm->slots_lock) to be held, otherwise a concurrent memslot update can free the memslots array under us once its SRCU grace period has elapsed.

As this is not fast path, following lock ordering (mutex first, then srcu) take the big hammer and hold the srcu for the full import.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-89922"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-16T11:17:01Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Take srcu when importing watchpoint data\n\n__import_wp_info() backs up the original guest memory contents of a\nwatchpoint with read_guest_abs(), which is kvm_read_guest() and therefore\nresolves the memslot via __kvm_memslots(). That requires kvm-\u003esrcu (or\nkvm-\u003eslots_lock) to be held, otherwise a concurrent memslot update can\nfree the memslots array under us once its SRCU grace period has elapsed.\n\nAs this is not fast path, following lock ordering (mutex first, then\nsrcu) take the big hammer and hold the srcu for the full import.",
  "id": "GHSA-x4qh-jwqp-j7jf",
  "modified": "2026-09-16T15:31:02Z",
  "published": "2026-09-16T12:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89922"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4c05bf21d1806853e662cc19e744736a3408f155"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6830fbc3724bf49c142aae69a4694f115fa9cedd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/76f5b4ea9ed0aa5a34bda9d8a878f2c73026ec03"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a4e482def8533ebace517d9f67f1465841b1f982"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cc710ee45395efb4937e042960f791d33924e5f6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f8e3a9997d5ecd56ebe4b262ff424516c068fecb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-89922 (GCVE-0-2026-89922)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:32 – Updated: 2026-09-16 14:40

Title

KVM: s390: Take srcu when importing watchpoint data

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data __import_wp_info() backs up the original guest memory contents of a watchpoint with read_guest_abs(), which is kvm_read_guest() and therefore resolves the memslot via __kvm_memslots(). That requires kvm->srcu (or kvm->slots_lock) to be held, otherwise a concurrent memslot update can free the memslots array under us once its SRCU grace period has elapsed. As this is not fast path, following lock ordering (mutex first, then srcu) take the big hammer and hold the srcu for the full import.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/6830fbc3724bf49c1…
https://git.kernel.org/stable/c/f8e3a9997d5ecd56e…
https://git.kernel.org/stable/c/76f5b4ea9ed0aa5a3…
https://git.kernel.org/stable/c/cc710ee45395efb49…
https://git.kernel.org/stable/c/4c05bf21d1806853e…
https://git.kernel.org/stable/c/a4e482def8533ebac…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 27291e2165b6de70c476b7b675308113edd69a60 , < 6830fbc3724bf49c142aae69a4694f115fa9cedd (git) Affected: 27291e2165b6de70c476b7b675308113edd69a60 , < f8e3a9997d5ecd56ebe4b262ff424516c068fecb (git) Affected: 27291e2165b6de70c476b7b675308113edd69a60 , < 76f5b4ea9ed0aa5a34bda9d8a878f2c73026ec03 (git) Affected: 27291e2165b6de70c476b7b675308113edd69a60 , < cc710ee45395efb4937e042960f791d33924e5f6 (git) Affected: 27291e2165b6de70c476b7b675308113edd69a60 , < 4c05bf21d1806853e662cc19e744736a3408f155 (git) Affected: 27291e2165b6de70c476b7b675308113edd69a60 , < a4e482def8533ebace517d9f67f1465841b1f982 (git)
Linux	Linux	Affected: 3.16 Unaffected: 0 , < 3.16 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kvm/kvm-s390.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6830fbc3724bf49c142aae69a4694f115fa9cedd",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            },
            {
              "lessThan": "f8e3a9997d5ecd56ebe4b262ff424516c068fecb",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            },
            {
              "lessThan": "76f5b4ea9ed0aa5a34bda9d8a878f2c73026ec03",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            },
            {
              "lessThan": "cc710ee45395efb4937e042960f791d33924e5f6",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            },
            {
              "lessThan": "4c05bf21d1806853e662cc19e744736a3408f155",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            },
            {
              "lessThan": "a4e482def8533ebace517d9f67f1465841b1f982",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kvm/kvm-s390.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Take srcu when importing watchpoint data\n\n__import_wp_info() backs up the original guest memory contents of a\nwatchpoint with read_guest_abs(), which is kvm_read_guest() and therefore\nresolves the memslot via __kvm_memslots(). That requires kvm-\u003esrcu (or\nkvm-\u003eslots_lock) to be held, otherwise a concurrent memslot update can\nfree the memslots array under us once its SRCU grace period has elapsed.\n\nAs this is not fast path, following lock ordering (mutex first, then\nsrcu) take the big hammer and hold the srcu for the full import."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the local KVM_SET_GUEST_DEBUG vCPU ioctl on a fd from /dev/kvm (kvm_vcpu_ioctl -\u003e kvm_arch_vcpu_ioctl_set_guest_debug -\u003e kvm_s390_import_bp_data). No network, adjacent-radio, or physical-device path reaches this s390 watchpoint import.\nAC:L - The attacker controls both sides of the race: one thread issues KVM_SET_GUEST_DEBUG with KVM_GUESTDBG_USE_HW_BP while another mutates memslots via KVM_SET_USER_MEMORY_REGION on the VM fd. Guest PER (sclp.has_gpere) is standard on s390 KVM hosts, not a rare config the attacker cannot influence.\nPR:L - The ioctl path has no capability check; only s390 ucontrol VMs require CAP_SYS_ADMIN. An unprivileged user with /dev/kvm access (kvm group or mode 0666, typical on virtualization hosts) can create a VM/vCPU and trigger the import.\nUI:N - The attacking process creates the VM and vCPU, installs hardware watchpoints, and races memslot updates itself. No separate victim user action such as mounting a filesystem or opening a file is required.\nS:U - KVM_SET_GUEST_DEBUG is a host-userspace ioctl; a guest cannot issue it, and this is not a guest-to-host escape. Impact stays within the host kernel\u0027s security authority, matching other KVM ioctl missing-SRCU UAFs.\nC:H - Without SRCU, read_guest_abs()/kvm_read_guest() resolves memslots via __kvm_memslots() while a concurrent update can kfree the kvm_memory_slot after the SRCU grace period. Use-after-free of slot metadata and gfn-tree nodes enables kernel-heap disclosure and is scored High.\nI:H - The same UAF lets the attacker reclaim the freed kvm_memory_slot, plant a dangling last_used_slot pointer, and walk attacker-controlled rb_left/rb_right during search_memslots(), yielding a kernel write/control-flow primitive. Kernel UAF memory corruption is scored High integrity.\nA:H - Dereferencing a freed kvm_memory_slot or walking a concurrently destroyed gfn rbtree causes a host kernel oops or panic. The unprotected srcu_dereference_check() also trips lockdep, which is fatal under panic_on_warn."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:40:15.723Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6830fbc3724bf49c142aae69a4694f115fa9cedd"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8e3a9997d5ecd56ebe4b262ff424516c068fecb"
        },
        {
          "url": "https://git.kernel.org/stable/c/76f5b4ea9ed0aa5a34bda9d8a878f2c73026ec03"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc710ee45395efb4937e042960f791d33924e5f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c05bf21d1806853e662cc19e744736a3408f155"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4e482def8533ebace517d9f67f1465841b1f982"
        }
      ],
      "title": "KVM: s390: Take srcu when importing watchpoint data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89922",
    "datePublished": "2026-09-16T10:32:16.110Z",
    "dateReserved": "2026-09-11T19:38:34.775Z",
    "dateUpdated": "2026-09-16T14:40:15.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-X4QH-JWQP-J7JF

CVE-2026-89922 (GCVE-0-2026-89922)

Tags

Sightings

Nomenclature

Related by attack behaviour