CVE-2026-89921: KVM: s390: Zero initialize data structures for inject_pfault_token
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Zero initialize data structures for injectpfaulttoken
kvminjectpfaulttoken() only sets .type and .u.ext.extparams2 of the on-stack struct kvms390irq but the full ext substructure is copied into the cpu local variable on inject. extparams and pad contain stale stack values.
Interrupt delivery only uses extparams2, so nothing leaks to the guest, but a host user can use the migration ioctls to get to the data.
Fix by zero-initializing the irq struct. Do the same for the inti data structure.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the issue by zero-initializing the irq struct used by KVM: s390 (specifically for inject_pfault_token / __kvm_inject_pfault_token) so that ext_params and pad do not contain stale stack values before being copied into the on-stack struct kvm_s390_irq.
Linux kernel KVM: s390 Zero-initialize kvm_s390_irq / inject_pfault_token data structure (irq struct) = enabled
Event History
Frequently Asked Questions
Who can access the stale data?
A host user who can use the KVM migration ioctls can reach the affected data. Interrupt delivery to the guest uses only ext_params2, so the described stale values are not leaked to the guest through interrupt delivery.
What condition is required for exploitation?
The attacker needs host-side access sufficient to use the KVM migration ioctls. The issue arises because fields in on-stack KVM s390 interrupt-related structures were not initialized before the full extended structure was copied.