CVE-2026-89920

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...

DEBIAN-CVE-2026-89921

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for injectpfaulttoken kvminjectpfaulttoken only sets .type and .u.ext.extparams2 of the on-stack struct kvms390irq but the full ext substructure is copied into the cpu local variable on...

CVE-2026-89922

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data importwpinfo backs up the original guest memory contents of a watchpoint with readguestabs, which is kvmreadguest and therefore resolves the memslot via kvmmemslots. That requir...

CVE-2026-89919

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: keyop: use mmulock to read gmap-asce Every other dat consumer in this file kvms390getskeys, setskeys, getcmmabits, setcmmabits, MEMCLRCMMA, kvms390fixupprefix, kvmtestagegfn, kvmagegfn reads kvm-arch.gmap-asce inside t...

EUVD-2026-80525

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory leak in guest debug handling bpdata is freed only for the error case by kfreebpdata. Every successful KVMSETGUESTDEBUG will leak bpdata...

EUVD-2026-80526

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, which is an int. The bounds check is done on the truncated value while the...

CVE-2026-89926

CVE-2026-89926 affects the Linux kernel KVM s390 subsystem in the __import_wp_info() function. The root cause is a type truncation : the user-space-controlled kvm_hw_breakpoint::len (a __u64) is assigned to wp_info->len (an int). The bounds check evaluates the truncated value, but the subseque...

CVE-2026-89925

CVE-2026-89925 affects the Linux kernel KVM s390 module. The root cause is a memory leak in the guest debug handling path: bp_data is freed via kfree() only in the error case of KVM_SET_GUEST_DEBUG, so every successful KVM_SET_GUEST_DEBUG call leaks the allocation. The practical impact is a per-c...

CVE-2026-89924

This Linux kernel vulnerability affects the KVM s390 subsystem's guest debug interface. In __import_wp_info(), per-watchpoint old_data buffers are allocated to back up original guest memory contents. When a later watchpoint in the same KVM_SET_GUEST_DEBUG request fails to import, kvm_s390_import_...

EUVD-2026-80524

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix olddata leak in guest debug error path importwpinfo allocates a per-watchpoint olddata buffer to back up the original guest memory contents. If a later watchpoint of the same KVMSETGUESTDEBUG request fails to impor...

EUVD-2026-80522

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data importwpinfo backs up the original guest memory contents of a watchpoint with readguestabs, which is kvmreadguest and therefore resolves the memslot via kvmmemslots. That requir...

EUVD-2026-80523

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Free guest debug data on vcpu destroy kvms390clearbpdata is only called from kvmarchvcpuioctlsetguestdebug, i.e. when user space changes or disables debugging. A vCPU that is destroyed while hardware breakpoints are...

CVE-2026-89922

CVE-2026-89922 is a race condition in the Linux kernel's KVM s390 subsystem. The function __import_wp_info() uses kvm_read_guest() to back up guest memory contents of a watchpoint, which resolves memslots via __kvm_memslots(). This call requires holding kvm->srcu (or kvm->slots_lock), but t...

CVE-2026-89923

This is a memory leak in the Linux kernel's KVM s390 module. When a vCPU is destroyed while hardware breakpoints remain armed (the normal case when a VMM exits or crashes), hw_bp_info, hw_wp_info, and old_data buffers are leaked because kvm_s390_clear_bp_data() is only invoked from the guest-debu...

CVE-2026-89921

CVE-2026-89921 affects the Linux kernel KVM s390 architecture. The function __kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack struct kvm_s390_irq, but the full ext substructure is copied into the CPU local variable on injection, leaving ext_params and pad with sta...

EUVD-2026-80519

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: keyop: use mmulock to read gmap-asce Every other dat consumer in this file kvms390getskeys, setskeys, getcmmabits, setcmmabits, MEMCLRCMMA, kvms390fixupprefix, kvmtestagegfn, kvmagegfn reads kvm-arch.gmap-asce inside t...

CVE-2026-89920

CVE-2026-89920 affects the Linux kernel's KVM s390 subsystem. The vulnerability arises when channel-subsystem damage (CK) machine checks are unnecessarily reinjected into a guest VM, even though the guest channel subsystem is emulated in the userspace VMM. This reinjection causes a kfree of a sta...

CVE-2026-89919 KVM: s390: keyop: use mmu_lock to read gmap->asce

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: keyop: use mmulock to read gmap-asce Every other dat consumer in this file kvms390getskeys, setskeys, getcmmabits, setcmmabits, MEMCLRCMMA, kvms390fixupprefix, kvmtestagegfn, kvmagegfn reads kvm-arch.gmap-asce inside t...

EUVD-2026-80520

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...

CVE-2026-89919

CVE-2026-89919 affects the Linux kernel's KVM s390 subsystem. The keyop function reads kvm->arch.gmap->asce without holding the mmu_lock read-side, unlike every other dat_* consumer in the same file. Because gmap->asce is mutated under write_lock(mmu_lock) by gmap_set_limit(), a concurre...