CVE-2026-89926: KVM: s390: Fix length check __import_wp_info()
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix length check importwpinfo()
struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo->len, which is an int. The bounds check is done on the truncated value while the allocation uses the untruncated one:
wpinfo->len = bpdata->len; [...] if (wpinfo->len < 0 || wpinfo->len > MAXWPSIZE) return -EINVAL;
wpinfo->olddata = kmalloc(bpdata->len, GFPKERNELACCOUNT);
Use the validated value for the allocation as intended. Without this fix userspace can trigger >4GB allocations which will fail and result in a WARN due to MAXPAGEORDER.
Affected Software
Event History
Frequently Asked Questions
What access is needed to trigger this issue?
An attacker needs to be able to supply KVM s390 hardware-breakpoint data from userspace, including control of the breakpoint length field. The issue arises because that user-controlled 64-bit length is validated after truncation but used untruncated for allocation.
What is the practical effect of exploitation?
Userspace can request allocations larger than 4 GB. These allocations fail and produce a WARN due to MAX_PAGE_ORDER.