CVE-2026-89922: KVM: s390: Take srcu when importing watchpoint data
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Take srcu when importing watchpoint data
importwpinfo() backs up the original guest memory contents of a watchpoint with readguestabs(), which is kvmreadguest() and therefore resolves the memslot via kvmmemslots(). That requires kvm->srcu (or kvm->slotslock) to be held, otherwise a concurrent memslot update can free the memslots array under us once its SRCU grace period has elapsed.
As this is not fast path, following lock ordering (mutex first, then srcu) take the big hammer and hold the srcu for the full import.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In KVM s390 watchpoint-data imports, acquire the mutex first, then hold kvm->srcu for the full import so concurrent memslot updates cannot free the memslots array.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The affected path is reached when KVM on s390 imports watchpoint data. Exploitation requires a concurrent KVM memslot update while the import operation reads guest memory, allowing the memslots array to be freed after its SRCU grace period.
Which systems are realistically exposed?
Systems using the Linux kernel's KVM implementation on s390 and performing watchpoint-data imports are implicated. The provided information does not identify affected kernel versions or state whether this path is enabled by default.
What is the remediation?
Apply a kernel update containing one of the referenced stable commits. The fix holds kvm->srcu throughout watchpoint-data import, preventing concurrent memslot updates from freeing the memslots array while it is in use.