CVE-2026-89921

KVM: s390: Zero initialize data structures for inject_pfault_token

State: Published
Severity: Not scored
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Zero initialize data structures for inject_pfault_token

__kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack struct kvm_s390_irq but the full ext substructure is copied into the cpu local variable on inject. ext_params and pad contain stale stack values.

Interrupt delivery only uses ext_params2, so nothing leaks to the guest, but a host user can use the migration ioctls to get to the data.

Fix by zero-initializing the irq struct. Do the same for the inti data structure.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	383d0b050106abecb82f43101cac94fa423af5cd to before 3da26db3323cbccf509005fdbc4ebae842d323cdAffected 383d0b050106abecb82f43101cac94fa423af5cd to before 5b0ae4443383fbacd905522f0c95ad6c85a3b43eAffected 383d0b050106abecb82f43101cac94fa423af5cd to before 7090818ba774d254eba80979c2d4da23d91de02fAffected 383d0b050106abecb82f43101cac94fa423af5cd to before ab1a8a3c9971200938093370da4c67d4427c25f2Affected 383d0b050106abecb82f43101cac94fa423af5cd to before b8abc760fa18a389319d977834a30550b3ec18e8Affected 383d0b050106abecb82f43101cac94fa423af5cd to before 9b046de62b8098af6e2ba820b125ec9dc5f162c8Affected 383d0b050106abecb82f43101cac94fa423af5cd to before 134f235e0e8de54611a72d3cc3f63e5f31246baaAffected 383d0b050106abecb82f43101cac94fa423af5cd to before 4e2c7f7cbc27418f9a290399b986c1b85ff93b90Affected
LinuxLinux	3.19Affected before 3.19Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

383d0b050106abecb82f43101cac94fa423af5cd to before 3da26db3323cbccf509005fdbc4ebae842d323cdAffected
383d0b050106abecb82f43101cac94fa423af5cd to before 5b0ae4443383fbacd905522f0c95ad6c85a3b43eAffected
383d0b050106abecb82f43101cac94fa423af5cd to before 7090818ba774d254eba80979c2d4da23d91de02fAffected
383d0b050106abecb82f43101cac94fa423af5cd to before ab1a8a3c9971200938093370da4c67d4427c25f2Affected
383d0b050106abecb82f43101cac94fa423af5cd to before b8abc760fa18a389319d977834a30550b3ec18e8Affected
383d0b050106abecb82f43101cac94fa423af5cd to before 9b046de62b8098af6e2ba820b125ec9dc5f162c8Affected
383d0b050106abecb82f43101cac94fa423af5cd to before 134f235e0e8de54611a72d3cc3f63e5f31246baaAffected
383d0b050106abecb82f43101cac94fa423af5cd to before 4e2c7f7cbc27418f9a290399b986c1b85ff93b90Affected

LinuxLinux

3.19Affected
before 3.19Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.