CVE-2026-89459 Overview
CVE-2026-89459 is a Linux kernel vulnerability affecting the s390 (IBM Z) architecture. The flaw resides in the MVIY_PERCPU() macro introduced by commit a737737cdb9c ("s390/percpu: Infrastructure for more efficient this_cpu operations"). When the kernel is built with GNU as from binutils versions older than 2.39, the assembler drops whitespace between quoted macro arguments during input scrubbing. The mviy instruction is never emitted, and the interrupted per-CPU sequence is not marked in lowcore. Consequently, the exception return path cannot repair the per-CPU address register after CPU migration, leading to memory corruption of per-CPU data structures.
Critical Impact
Silent build-time miscompilation on s390 kernels using binutils < 2.39, resulting in corrupted per-CPU state after task migration between CPUs.
Affected Products
- Linux kernel builds on the s390 (IBM Z) architecture using MVIY_PERCPU()
- Kernels compiled with GNU binutils versions prior to 2.39
- Stable kernel branches referenced in commits 101782f8945a and 91770b08a120
Discovery Timeline
- 2026-09-11 - CVE-2026-89459 published to the National Vulnerability Database (NVD)
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89459
Vulnerability Analysis
The defect is a toolchain-interaction bug in s390 per-CPU infrastructure. MVIY_PERCPU() was designed to emit an mviy (move immediate with per-CPU addressing) instruction through the GEN_MVIY assembler macro. The C-side wrapper stringified arguments that were already string literals, producing an assembler macro call with two whitespace-separated quoted tokens such as GEN_MVIY "459712" "%r3".
GNU as prior to binutils 2.39 collapses that whitespace during input scrubbing and parses both quoted tokens as a single argument. The .ifc conditional inside GEN_MVIY never matches any expected register, so no instruction is emitted. The assembler reports only a warning: missing closing "' and exits successfully, producing a kernel image without the required mviy opcodes.
Root Cause
The root cause is unsafe argument construction in an inline assembler helper combined with a documented parsing behavior of older GNU as. Because Linux supports binutils from 2.30 onward, kernels built with any tooling in that range silently miscompile the per-CPU sequence. Without the emitted mviy, the interrupted per-CPU critical section is not recorded in lowcore, breaking the contract the exception return path relies on to restore the per-CPU address register after migration.
Attack Vector
Exploitation requires local access with low privileges on an affected s390 system. An attacker who can trigger frequent task migration and per-CPU updates can provoke inconsistent per-CPU state, resulting in memory corruption, information disclosure across CPUs, or kernel instability. The scope is limited to affected s390 kernel builds; other architectures are not impacted.
No exploitation code is published, and no public proof-of-concept is available. Refer to the upstream fix in commits 101782f8945a and 91770b08a120 for the corrected macro definition, which passes literals directly and separates arguments with an explicit comma (GEN_MVIY 459712, %r3).
Detection Methods for CVE-2026-89459
Indicators of Compromise
- Build logs containing repeated GNU as warnings of the form Warning: missing closing "' during compilation of s390 per-CPU code.
- Absence of mviy opcodes in the disassembly of functions that invoke MVIY_PERCPU().
- Sporadic per-CPU data corruption or kernel oops on s390 hosts under workloads that trigger frequent CPU migration.
Detection Strategies
- Inventory s390 kernel images and identify the binutils version used to build them; flag any build produced with as prior to 2.39.
- Inspect kernel binaries for the presence of mviy instructions in per-CPU code paths as a compile-time correctness check.
- Correlate kernel crash telemetry on s390 fleets against per-CPU subsystem call sites to surface silent miscompilation symptoms.
Monitoring Recommendations
- Ingest kernel build pipeline logs into a centralized log platform and alert on the missing closing assembler warning.
- Monitor s390 hosts for kernel oops, panics, and scheduler anomalies that follow task migration events.
- Track binutils versions across build agents and container images to prevent regressions to pre-2.39 toolchains.
How to Mitigate CVE-2026-89459
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in commits 101782f8945a and 91770b08a120.
- Rebuild affected s390 kernels and redeploy across the fleet.
- Restrict local access on s390 hosts until patched kernels are installed.
Patch Information
The fix removes the redundant stringification in MVIY_PERCPU(), passes C string literals directly to GEN_MVIY, and separates macro arguments with an explicit comma. The resulting invocation GEN_MVIY 459712, %r3 is parsed unambiguously by both GNU as and LLVM's integrated assembler. The GNU as input scrubbing behavior was corrected upstream in binutils 2.39, but Linux still supports binutils 2.30, so the kernel-side fix is required.
Workarounds
- Upgrade the build toolchain to GNU binutils 2.39 or later before compiling s390 kernels.
- Alternatively, switch to LLVM's integrated assembler, which parses the original macro invocation correctly.
- Audit CI/CD pipelines to enforce a minimum binutils version for s390 kernel builds until the patch is applied.
# Verify installed binutils version on a build host
as --version | head -n 1
# Confirm the patched kernel sources contain the fixed macro form
grep -R "GEN_MVIY" arch/s390/include/asm/percpu.h
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
