CVE-2026-98930: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
When injectsigpstop() is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread performing the KVMRUN IOCTL.
If the vCPU is already stopped, the status is stored immediately.
Storing the status means writing into userspace, which might fault, and injectsigpstop() is called from doinjectvcpu() which in turn is always called holding a spinlock, which is obviously an issue.
Fix this by returning -EWOULDBLOCK from injectsigpstop(), and adding a bool flag to indicate whether a store status is needed. The callers of doinjectvcpu() are modified to pass the pointer to the bool flag; whenever a Store Status operation is needed, the callers can now perform it outside the spinlock.
Opportunistically refactor kvms390setirqstate() to use scopedguard() and free().
[ Added Fixes tag while picking -- Claudio ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Modify KVM s390 SIGP Stop and Store Status handling so __inject_sigp_stop() returns -EWOULDBLOCK when the vCPU is running and a status store is required; pass a boolean flag through do_inject_vcpu() callers, perform the userspace status write in the thread executing KVM_RUN outside the spinlock, and store the status immediately when the vCPU is already stopped.