CVE-2026-89920: Linux Kernel KVM s390 Privilege Escalation

CVE-2026-89920 Overview

CVE-2026-89920 is a Linux kernel vulnerability in the KVM (Kernel-based Virtual Machine) subsystem for the s390 architecture. The flaw affects the handling of channel-subsystem (CK) damage machine checks that were incorrectly reinjected into guest virtual machines. The reinjection logic performed a kfree() operation on a stack-allocated variable, producing memory corruption in kernel space. IBM Z systems running KVM guests are the affected platform.

Critical Impact

A local attacker with guest privileges can trigger kernel memory corruption on the host, potentially leading to host compromise, privilege escalation, or denial of service across all co-hosted virtual machines.

Affected Products

• Linux kernel KVM subsystem on IBM s390 architecture
• Host systems running KVM guests on IBM Z hardware
• Distributions shipping affected upstream Linux kernel versions prior to the fix commits

Discovery Timeline

• 2026-09-16 - CVE-2026-89920 published to the National Vulnerability Database (NVD)
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89920

Vulnerability Analysis

The vulnerability resides in the KVM s390 machine check injection path. Channel-subsystem damage machine checks (CK bit) are strictly host-scoped events on IBM Z, because the guest channel subsystem is emulated in the userspace VMM. The kernel nevertheless attempted to reinject these events into the guest via the machine check reinjection logic.

During this reinjection, the code invoked kfree() on a variable allocated on the kernel stack rather than on the heap. This kernel-space memory corruption falls under the [CWE-590] class of freeing memory not on the heap. A guest that induces a channel-subsystem damage event can therefore corrupt host kernel memory structures.

Root Cause

The root cause is twofold. First, the reinjection path did not filter out machine checks whose scope is the host channel subsystem. Second, the s390_backup_mcck_info() routine did not mask the CK bit from composite machine check descriptors, even though the closely related CP and ED bits were already masked. Composite events carrying both CK and instruction-damage bits therefore bypassed filtering and reached the flawed reinjection path.

Attack Vector

Exploitation requires local access with low privileges inside a KVM guest running on an s390 host. The attacker must be able to trigger or influence machine check events reachable by the guest. Successful triggering causes the host kernel to kfree() a stack address, corrupting kernel memory. The scope is changed because a guest-context event compromises host-context integrity.

No public exploit is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream fix commits for the exact code change in the Kernel Git Commit Fix.

Detection Methods for CVE-2026-89920

Indicators of Compromise

• Unexpected kernel Oops, BUG:, or slab-out-of-bounds messages in dmesg on s390 KVM hosts referencing machine check handling paths.
• KVM guest crashes correlated with host-side machine check events in /var/log/messages or journalctl -k.
• Presence of stack-trace entries involving s390_backup_mcck_info or KVM s390 machine check reinjection functions.

Detection Strategies

• Inventory s390 hosts and verify running kernel version against the patched commits 6ee52d3af2a1, 7077ec953996, and 546dde823a36.
• Monitor host kernel logs for panics or memory corruption diagnostics coinciding with guest activity.
• Correlate guest lifecycle events (start, crash, reboot) with host machine check counters exposed via /proc/interrupts and s390 hardware telemetry.

Monitoring Recommendations

• Enable persistent kernel crash logging with kdump on all s390 KVM hosts to preserve corruption evidence.
• Forward host kernel logs to a centralized logging or SIEM platform and alert on KVM subsystem stack traces.
• Track guest-to-host machine check event rates as a baseline metric; alert on statistically anomalous spikes.

How to Mitigate CVE-2026-89920

Immediate Actions Required

• Apply the upstream Linux kernel patch on all IBM Z hosts running KVM guests.
• Update to distribution kernels that include the fix once vendors publish backports.
• Restrict guest administrative access on multi-tenant s390 KVM hosts until patching is complete.

Patch Information

The fix is delivered in three upstream commits: Kernel Git Commit Fix, Kernel Git Commit Change, and Kernel Git Commit Update. The fix stops reinjecting CK machine checks into guests and masks the CK bit inside s390_backup_mcck_info() alongside the previously masked CP and ED bits.

Workarounds

• No documented software workaround exists; the upstream kernel patch is the authoritative remediation.
• Reduce exposure by minimizing untrusted guest workloads on unpatched s390 KVM hosts.
• Where feasible, migrate critical workloads to already-patched hosts using live migration before applying updates.

# Verify running kernel version on an s390 KVM host
uname -r

# Check whether the fix commit is present in the running kernel source tree
git -C /usr/src/linux log --oneline | grep -E '6ee52d3af2a1|7077ec953996|546dde823a36'

# Example: apply distribution kernel updates (RHEL/SLES-style)
sudo zypper refresh && sudo zypper update kernel-default
sudo dnf update kernel