CVE-2026-98652: KVM: s390: Add missing srcu in kvm_s390_set_irq_state()
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Add missing srcu in kvms390setirqstate()
Like kvms390injectvcpu(), kvms390setirqstate() also needs the kvm->srcu or the slots lock when performing the Store status operation.
Fix by taking kvm->srcu in kvms390setirqstate().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In kvm_s390_set_irq_state(), take kvm->srcu or the slots lock when performing the Store status operation.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems using KVM on the s390 architecture, where kvm_s390_set_irq_state() can perform a Store status operation.
What condition triggers the vulnerability?
The vulnerable path is reached when kvm_s390_set_irq_state() performs the Store status operation without holding either kvm->srcu or the slots lock. The fix takes kvm->srcu in that function.
How can I determine whether my kernel includes the fix?
Check whether your kernel incorporates either referenced stable commit: 7a33007b95c8908ae3980eb2b4c508f8936766df or f3a557067d57ce6ae98d485c8009b223e16f5f36.