CVE-2026-89920

KVM: s390: Fix memory corruption by not reinjecting CK machine checks

State
Published
Severity
7.8 High
Published
Sep 16, 2026
Updated
Oct 30, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Fix memory corruption by not reinjecting CK machine checks

Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in forwarding such machine checks into the guest.

This also simplifies the machine check reinjection and avoids kfree of a stack variable as reported by sashiko. There might be still machine checks that have the ck bit set with another bit (like instruction damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and ED bits already are.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 to before 045f3e95a0deccb277c29bd003e1d43c0ad40c90Affected
  • 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 to before 5c63e2ed840c85e27172ab78e7db3ac77fba281bAffected
  • 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 to before b7631982fb65dd355acd18e62b384bc8125e9c44Affected
  • 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 to before 6ee52d3af2a1bf70349cf3f860933c8d221e229aAffected
  • 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 to before 7077ec953996acc04b49d1dfc43df1c1a2a74395Affected
  • 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 to before 546dde823a36d7283dcf46127c2f3d093443860fAffected
LinuxLinux
  • 4.13Affected
  • before 4.13Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.51 through 6.18.*Not affected
  • 7.2.5 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.