CVE-2026-89922

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data __import_wp_info() backs up the original guest memory contents of a watchpoint with read_guest_abs(), which is kvm_read_guest() and therefore resolves the memslot via __kvm_memslots(). That requires kvm->srcu (or kvm->slots_lock) to be held, otherwise a concurrent memslot update can free the memslots array under us once its SRCU grace period has elapsed. As this is not fast path, following lock ordering (mutex first, then srcu) take the big hammer and hold the srcu for the full import.

Severity

HIGH

CVSS score

7.8 (v3.1)

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-16 11:17:01.277000

Last modified

2026-10-19 09:18:37.693000

View original CVE JSON

{
  "id": "CVE-2026-89922",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-16T11:17:01.277",
  "lastModified": "2026-10-19T09:18:37.693",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Take srcu when importing watchpoint data\n\n__import_wp_info() backs up the original guest memory contents of a\nwatchpoint with read_guest_abs(), which is kvm_read_guest() and therefore\nresolves the memslot via __kvm_memslots(). That requires kvm->srcu (or\nkvm->slots_lock) to be held, otherwise a concurrent memslot update can\nfree the memslots array under us once its SRCU grace period has elapsed.\n\nAs this is not fast path, following lock ordering (mutex first, then\nsrcu) take the big hammer and hold the srcu for the full import."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "arch/s390/kvm/kvm-s390.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "lessThan": "6830fbc3724bf49c142aae69a4694f115fa9cedd",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "lessThan": "f8e3a9997d5ecd56ebe4b262ff424516c068fecb",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "lessThan": "76f5b4ea9ed0aa5a34bda9d8a878f2c73026ec03",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "lessThan": "cc710ee45395efb4937e042960f791d33924e5f6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "lessThan": "4c05bf21d1806853e662cc19e744736a3408f155",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "lessThan": "a4e482def8533ebace517d9f67f1465841b1f982",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "arch/s390/kvm/kvm-s390.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.188",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.157",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.110",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.51",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.5",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/4c05bf21d1806853e662cc19e744736a3408f155",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6830fbc3724bf49c142aae69a4694f115fa9cedd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/76f5b4ea9ed0aa5a34bda9d8a878f2c73026ec03",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a4e482def8533ebace517d9f67f1465841b1f982",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cc710ee45395efb4937e042960f791d33924e5f6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f8e3a9997d5ecd56ebe4b262ff424516c068fecb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}