UBUNTU-CVE-2026-89919: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: keyop: use mmulock to read gmap->asce Every other dat consumer in this file (kvms390getskeys, setskeys, getcmmabits, setcmmabits, MEMCLRCMMA, kvms390fixupprefix, kvmtestagegfn, kvmagegfn) reads kvm->arch.gmap->asce inside the mmulock read-side. keyop is the only outlier. gmap->asce is mutated under writelock(mmulock) by gmapsetlimit() and keyop might use a stale asce value for walking as KVMS390KEYOP and KVMS390VMMEMLIMITSIZE can run concurrently. This can result in memory corruption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The race requires KVM s390 key operations and KVM virtual-machine memory-limit changes to run concurrently. In that condition, key operations can use a stale gmap address-space-control element value while walking memory.
What level of access does an attacker need?
The severity vector indicates local access, low privileges, and no user interaction are required. Successful exploitation can result in memory corruption with high confidentiality, integrity, and availability impact.
What can be done until the resolved kernel update is deployed?
Avoid allowing KVM_S390_KEYOP operations to run concurrently with KVM_S390_VM_MEM_LIMIT_SIZE changes. This prevents the specific stale-value race described in the vulnerability.