CVE-2026-89922 Overview
CVE-2026-89922 affects the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem on the IBM s390 architecture. The flaw resides in __import_wp_info(), which backs up guest memory contents for a watchpoint using read_guest_abs(). This function resolves the memslot via __kvm_memslots() without holding the required kvm->srcu or kvm->slots_lock. A concurrent memslot update can free the memslots array after its Sleepable Read-Copy-Update (SRCU) grace period elapses, leading to a use-after-free condition inside the kernel.
Critical Impact
A local, authenticated user with access to KVM watchpoint import functionality on s390 can trigger a race condition against memslot updates, resulting in kernel memory corruption with high confidentiality, integrity, and availability impact.
Affected Products
- Linux kernel KVM subsystem on the s390 (IBM Z) architecture
- Multiple upstream kernel branches referenced by stable commits 4c05bf2, 6830fbc, 76f5b4e, a4e482d, cc710ee, and f8e3a99
- Distribution kernels shipping affected s390 KVM code prior to the backported fix
Discovery Timeline
- 2026-09-16 - CVE-2026-89922 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89922
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] in the KVM s390 watchpoint import path. __import_wp_info() reads guest absolute memory through read_guest_abs(), which invokes kvm_read_guest() and eventually __kvm_memslots() to look up the target memslot. KVM protects the memslots array with SRCU. Readers must hold kvm->srcu or the kvm->slots_lock mutex so that in-flight updates cannot release the old memslots pointer.
Because the watchpoint import path acquired neither, a concurrent VM ioctl performing a memslot update could complete an SRCU grace period and free the memslots array while __import_wp_info() still dereferenced it. The result is a classic use-after-free on kernel-controlled data structures.
The upstream fix takes the SRCU lock across the full import operation. This follows the documented lock ordering of mutex first, then SRCU, avoiding new deadlock paths. The path is not performance-critical, so holding SRCU for the entire operation is acceptable.
Root Cause
The root cause is missing synchronization around SRCU-protected memslot data. __import_wp_info() calls into helpers that require the caller to hold kvm->srcu, but the function itself did not acquire the lock. This violates the KVM memslot access contract on s390.
Attack Vector
Exploitation requires local, low-privileged access to a host that exposes KVM ioctls for s390 guests. An attacker with permission to configure guest debugging can invoke the watchpoint import while another thread performs memslot updates. Winning the race causes kernel memory to be read from a freed slots array, enabling denial of service or memory corruption that may lead to privilege escalation.
No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are available in the referenced Linux kernel stable commits.
Detection Methods for CVE-2026-89922
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing __import_wp_info, read_guest_abs, kvm_read_guest, or __kvm_memslots on s390 hosts
- KASAN or KFENCE reports of use-after-free involving KVM memslot structures
- Repeated KVM guest debug ioctl activity concurrent with memslot update ioctls from the same or related processes
Detection Strategies
- Compare running kernel versions against the fixed stable branches identified by commits 4c05bf2, 6830fbc, 76f5b4e, a4e482d, cc710ee, and f8e3a99
- Enable KASAN on test s390 kernels to surface use-after-free access in the KVM watchpoint path
- Correlate host dmesg output with virtualization control-plane logs to identify guests issuing high volumes of watchpoint or memslot ioctls
Monitoring Recommendations
- Alert on unexpected kernel crashes on s390 hypervisors running KVM workloads
- Track privileged local users authorized to interact with /dev/kvm and audit their ioctl usage
- Monitor kernel package versions across the fleet to confirm the patched build is deployed
How to Mitigate CVE-2026-89922
Immediate Actions Required
- Inventory all s390 hosts running KVM and identify kernels that predate the referenced stable fixes
- Schedule kernel upgrades to a version containing the SRCU-locking fix in __import_wp_info()
- Restrict access to /dev/kvm and guest debug interfaces to trusted administrators only
Patch Information
The fix wraps the watchpoint import in kvm->srcu so that read_guest_abs() safely resolves memslots. It is available in the upstream stable commits 4c05bf2, 6830fbc, 76f5b4e, a4e482d, cc710ee, and f8e3a99. Apply the vendor-provided kernel update for your distribution.
Workarounds
- Disable or restrict guest debugging features that exercise the KVM watchpoint import path on unpatched hosts
- Limit tenants able to launch untrusted s390 guests on shared hypervisors until patches are applied
- Reduce the number of concurrent memslot update operations by avoiding hot-plug memory changes during guest debug sessions
# Verify the running s390 host kernel version and KVM module status
uname -r
lsmod | grep kvm
# Restrict /dev/kvm access to a dedicated group
chown root:kvm /dev/kvm
chmod 0660 /dev/kvm
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
