CVE-2026-89926 Overview
CVE-2026-89926 is a Linux kernel vulnerability in the KVM subsystem for the s390 architecture. The flaw resides in the __import_wp_info() function, which handles hardware watchpoint imports for KVM guests. Userspace fully controls the struct kvm_hw_breakpoint::len field, defined as a __u64. The kernel assigns this value to wp_info->len, an int, and performs bounds checking on the truncated value while allocating memory using the untruncated original. Userspace can trigger allocations larger than 4GB, which fail and produce a kernel WARN due to MAX_PAGE_ORDER.
Critical Impact
A local userspace process with KVM access on s390 systems can trigger oversized kernel allocations, resulting in denial of service through kernel warnings and failed memory operations.
Affected Products
- Linux kernel KVM subsystem on s390 architecture
- Multiple stable kernel branches referenced across seven upstream fix commits
- Systems exposing /dev/kvm to unprivileged or semi-privileged userspace on IBM Z platforms
Discovery Timeline
- 2026-09-16 - CVE-2026-89926 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89926
Vulnerability Analysis
The vulnerability is a numeric truncation error [CWE-681] combined with an inconsistent validation pattern. In __import_wp_info(), the code copies bp_data->len (a 64-bit unsigned integer from userspace) into wp_info->len (a signed 32-bit int). The subsequent bounds check compares the truncated 32-bit value against MAX_WP_SIZE, but the allocation call uses the original 64-bit bp_data->len value.
Because the check and the allocation operate on different representations of the same field, a userspace-supplied length such as 0x100000000 truncates to 0 in wp_info->len and passes validation. The kmalloc() call then attempts to allocate the full 64-bit size, exceeding MAX_PAGE_ORDER and producing a kernel warning.
The upstream fix uses the validated wp_info->len value for the allocation instead of the raw bp_data->len, ensuring the checked value and the allocated size match.
Root Cause
The root cause is a type mismatch between a userspace-controlled __u64 field and a signed int kernel field. Validation logic operates on the narrowed value while the allocation uses the wide value. This creates a validation bypass driven by silent integer truncation.
Attack Vector
Exploitation requires local access to the KVM device interface on an s390 host. An attacker configures a guest hardware breakpoint through the KVM ioctl interface with a len field greater than UINT_MAX. The oversized allocation triggers a page allocator failure and a kernel WARN, degrading host stability and generating log noise. The vulnerability does not directly grant code execution but enables reliable resource-exhaustion behavior in a privileged kernel path.
For patch details, see the upstream commits: Kernel Commit 3fe801d, Kernel Commit 4c07680, and Kernel Commit b94ab9c.
Detection Methods for CVE-2026-89926
Indicators of Compromise
- Kernel WARN messages referencing MAX_PAGE_ORDER or page allocator failures originating from KVM code paths
- Repeated failed KVM_SET_GUEST_DEBUGioctl calls from the same process on s390 hosts
- Unexpected large-order allocation attempts logged from kmalloc in kvm-s390 modules
Detection Strategies
- Monitor dmesg and journalctl -k output on s390 KVM hosts for allocation-related warnings tied to KVM breakpoint handling
- Audit processes issuing KVM_SET_GUEST_DEBUGioctl calls and correlate with subsequent kernel warnings
- Baseline kernel warning volume on virtualization hosts and alert on statistical deviations
Monitoring Recommendations
- Forward kernel logs from all s390 KVM hosts to a centralized SIEM or data lake for correlation
- Track access to /dev/kvm by user and process to identify non-standard callers
- Alert on repeated EINVAL returns from KVM debug ioctl paths, which may indicate probing behavior
How to Mitigate CVE-2026-89926
Immediate Actions Required
- Apply the upstream stable kernel updates containing the fix to __import_wp_info() on all s390 KVM hosts
- Restrict access to /dev/kvm to trusted users and virtualization daemons through group permissions
- Audit which local users and services can invoke KVM ioctl interfaces on IBM Z systems
Patch Information
The fix is available in multiple stable kernel branches through the following commits: Kernel Commit 3fe801d, Kernel Commit 4c07680, Kernel Commit 71153d3, Kernel Commit aef5401, Kernel Commit b94ab9c, Kernel Commit beb9c55, and Kernel Commit fec89d3. The patch uses the validated wp_info->len value in the kmalloc() call, aligning the check and the allocation on the same integer representation.
Workarounds
- Limit /dev/kvm access to a dedicated kvm group and remove world-accessible permissions where feasible
- Run virtualization workloads under mandatory access control profiles (SELinux, AppArmor) that constrain ioctl usage
- On multi-tenant s390 hosts, isolate untrusted workloads from KVM-capable nodes until the patched kernel is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
