CVE-2026-89921: Linux Kernel KVM Information Disclosure

CVE-2026-89921 Overview

CVE-2026-89921 is an uninitialized memory use vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the s390 architecture. The flaw resides in __kvm_inject_pfault_token(), which populates only the .type and .u.ext.ext_params2 fields of an on-stack struct kvm_s390_irq. The remaining fields (ext_params and pad) retain stale kernel stack values. While interrupt delivery to guests uses only ext_params2, a host user with access to the migration ioctls can retrieve the uninitialized stack contents, leading to kernel memory disclosure.

Critical Impact
A privileged host user on an s390 system running KVM can read stale kernel stack data through migration ioctls, potentially exposing sensitive kernel memory to userspace.

Affected Products

Linux kernel KVM subsystem for the IBM s390 architecture
Kernel branches prior to the fixes referenced in commits 134f235, 4e2c7f7, and 9b046de
Distributions shipping vulnerable s390 KVM builds

Discovery Timeline

2026-09-16 - CVE-2026-89921 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89921

Vulnerability Analysis

The vulnerability is an uninitialized memory use issue [CWE-908] in the s390 KVM interrupt injection path. The function __kvm_inject_pfault_token() declares a struct kvm_s390_irq on the stack and populates only two fields before the structure is copied into a per-CPU variable during injection. The ext substructure is copied in full, so its untouched members carry whatever bytes previously occupied that stack region.

Although guest-visible interrupt delivery consumes only ext_params2, the stale bytes persist inside kernel-tracked interrupt state. A host user invoking the KVM migration ioctls, which serialize pending interrupt state for saving or restoring virtual machines, can read the uninitialized ext_params and pad fields. This produces a controlled disclosure of arbitrary kernel stack contents. The same class of bug affects the inti data structure used elsewhere in the injection path.

Root Cause

The root cause is the absence of zero-initialization for the on-stack struct kvm_s390_irq and the corresponding inti structure. C stack allocations do not implicitly clear memory. When only a subset of fields is assigned before a bulk copy, the remaining bytes leak whatever prior function frames wrote to that stack region.

Attack Vector

Exploitation requires local access to the host with privileges sufficient to invoke KVM migration ioctls on a running guest, typically a virtualization management user or process. The attacker triggers a page-fault token injection path and then reads back the saved interrupt state via the migration interface. The recovered bytes originate from the kernel stack and may contain pointers, credentials, or other secrets useful for defeating KASLR or staging further attacks. The vulnerability is confined to the s390 architecture.

See the upstream fixes: Kernel Git Commit 134f235, Kernel Git Commit 4e2c7f7, and Kernel Git Commit 9b046de.

Detection Methods for CVE-2026-89921

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-89921.
Because the disclosure occurs entirely in-kernel and via legitimate ioctl paths, exploitation leaves minimal on-disk artifacts.
Unexpected use of KVM migration ioctls (KVM_S390_GET_IRQ_STATE) against running guests by non-management users warrants review.

Detection Strategies

Inventory s390 hosts running KVM and compare installed kernel versions against the patched commits 134f235, 4e2c7f7, and 9b046de.
Audit which local users and services have access to /dev/kvm and the ability to issue guest migration ioctls.
Monitor auditd rules for unusual ioctl activity against KVM file descriptors from unexpected UIDs.

Monitoring Recommendations

Enable Linux audit logging for ioctl syscalls targeting /dev/kvm on s390 hypervisors and forward events to a centralized data lake for correlation.
Track kernel package versions across the s390 fleet using a configuration management system to identify hosts pending patch.
Alert on new local accounts or group membership changes that grant access to virtualization management interfaces.

How to Mitigate CVE-2026-89921

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 134f235e0e8de5, 4e2c7f7cbc2741, and 9b046de62b8098 on all affected s390 KVM hosts.
Update to distribution kernel packages that incorporate these fixes and reboot the affected systems.
Restrict access to /dev/kvm and KVM migration ioctls to trusted virtualization management accounts only.

Patch Information

The fix zero-initializes the struct kvm_s390_irq and the inti data structure before populating them, ensuring stale stack bytes cannot propagate into saved interrupt state. The change is available in the mainline and stable kernel trees via the three referenced Git commits. Consult your distribution's security tracker for the specific package versions containing the backport.

Workarounds

Limit local host accounts capable of invoking KVM migration ioctls; enforce least privilege for virtualization operators.
Avoid granting untrusted users access to guest live migration or state save/restore workflows on unpatched s390 hosts.
Where feasible, disable live migration for sensitive workloads until the patched kernel is deployed.

bash

# Verify running kernel version on an s390 KVM host
uname -r

# Confirm the patched commits are present in the distribution kernel changelog
rpm -q --changelog kernel | grep -E '134f235|4e2c7f7|9b046de'

# Restrict access to /dev/kvm to the kvm group only
chown root:kvm /dev/kvm
chmod 0660 /dev/kvm