UBUNTU-CVE-2026-89921: Low severity ubuntu/linux-aws vulnerability
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for injectpfaulttoken kvminjectpfaulttoken() only sets .type and .u.ext.extparams2 of the on-stack struct kvms390irq but the full ext substructure is copied into the cpu local variable on inject. extparams and pad contain stale stack values. Interrupt delivery only uses extparams2, so nothing leaks to the guest, but a host user can use the migration ioctls to get to the data. Fix by zero-initializing the irq struct. Do the same for the inti data structure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In __kvm_inject_pfault_token(), zero-initialize the on-stack struct kvm_s390_irq before setting .type and .u.ext.ext_params2, so the full ext substructure copied during interrupt injection does not contain stale stack values.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Exposure is limited to systems using the affected Ubuntu Linux kernel packages where KVM on s390 is in use. A host user able to use KVM migration ioctls may be able to retrieve stale host stack data.
What access does an attacker need?
The issue requires local, high-privileged access, as reflected by the vector. The attacker must be able to interact with the KVM migration ioctl interface; guest interrupt delivery itself does not leak the data.
What data could be exposed?
The uninitialized fields can contain stale stack values from the host. Only confidentiality is affected; the provided data indicates no integrity or availability impact.
Is guest-side exploitation possible through interrupt delivery?
No. The description states that interrupt delivery uses only ext_params2, so the stale values are not leaked to the guest through that path.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-fips, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, and ubuntu/linux-gcp-fips.