EUVD-2026-80522

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data importwpinfo backs up the original guest memory contents of a watchpoint with readguestabs, which is kvmreadguest and therefore resolves the memslot via kvmmemslots. That requir...

EUVD-2026-80523

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Free guest debug data on vcpu destroy kvms390clearbpdata is only called from kvmarchvcpuioctlsetguestdebug, i.e. when user space changes or disables debugging. A vCPU that is destroyed while hardware breakpoints are...

CVE-2026-89922

CVE-2026-89922 is a race condition in the Linux kernel's KVM s390 subsystem. The function __import_wp_info() uses kvm_read_guest() to back up guest memory contents of a watchpoint, which resolves memslots via __kvm_memslots(). This call requires holding kvm->srcu (or kvm->slots_lock), but t...

CVE-2026-89923

This is a memory leak in the Linux kernel's KVM s390 module. When a vCPU is destroyed while hardware breakpoints remain armed (the normal case when a VMM exits or crashes), hw_bp_info, hw_wp_info, and old_data buffers are leaked because kvm_s390_clear_bp_data() is only invoked from the guest-debu...

CVE-2026-89921

CVE-2026-89921 affects the Linux kernel KVM s390 architecture. The function __kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack struct kvm_s390_irq, but the full ext substructure is copied into the CPU local variable on injection, leaving ext_params and pad with sta...

CVE-2026-89920

CVE-2026-89920 affects the Linux kernel's KVM s390 subsystem. The vulnerability arises when channel-subsystem damage (CK) machine checks are unnecessarily reinjected into a guest VM, even though the guest channel subsystem is emulated in the userspace VMM. This reinjection causes a kfree of a sta...

EUVD-2026-80520

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...

EUVD-2026-80519

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: keyop: use mmulock to read gmap-asce Every other dat consumer in this file kvms390getskeys, setskeys, getcmmabits, setcmmabits, MEMCLRCMMA, kvms390fixupprefix, kvmtestagegfn, kvmagegfn reads kvm-arch.gmap-asce inside t...

CVE-2026-89919 KVM: s390: keyop: use mmu_lock to read gmap->asce

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: keyop: use mmulock to read gmap-asce Every other dat consumer in this file kvms390getskeys, setskeys, getcmmabits, setcmmabits, MEMCLRCMMA, kvms390fixupprefix, kvmtestagegfn, kvmagegfn reads kvm-arch.gmap-asce inside t...

CVE-2026-89919

CVE-2026-89919 affects the Linux kernel's KVM s390 subsystem. The keyop function reads kvm->arch.gmap->asce without holding the mmu_lock read-side, unlike every other dat_* consumer in the same file. Because gmap->asce is mutated under write_lock(mmu_lock) by gmap_set_limit(), a concurre...

CVE-2026-89920 KVM: s390: Fix memory corruption by not reinjecting CK machine checks

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...

EUVD-2026-80518

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start an...

CVE-2026-89918

CVE-2026-89918 affects the Linux kernel KVM arm64 subsystem. The root cause is a flaw in the TLB invalidation (TLBI) by virtual address range: when the TLBI instruction's range reaches the end of the TTBR1 VA space , the expression base + size wraps around to 0, causing the range comparison to fa...

CVE-2026-89918 KVM: arm64: Correctly handle end of VA space TLBI invalidation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start an...

CVE-2026-89917

A race condition in the Linux kernel's KVM arm64 hypervisor exists between the VNCR TLB invalidation path (which runs under the MMU lock) and vcpu_put() 's VNCR unmapping (which does not). The TOCTOU pattern on the TLB path checks vncr_tlb::cpu before unmapping, while this_cpu_reset_vncr_fixmap()...

EUVD-2026-80517

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle VNCR TLB invalidation race with vcpuput VNCR unmapping While VNCR TLB invalidation always occurs under the MMU lock, vcpuput doesn't, while it unmaps the VNCR page. The problem is that the invalidation evaluate...

CVE-2026-89916

CVE-2026-89916 is a race condition in the Linux kernel's KVM arm64 subsystem where VNCR TLB invalidation did not participate in the MMU invalidation retry mechanism. When one vCPU invalidates a page via TLBI S1E2 while another vCPU is concurrently faulting in the same page, the faulting vCPU can ...

CVE-2026-89915

This vulnerability affects the Linux kernel's KVM arm64 subsystem, where a flawed VM-wide VNCR mapping counter is used to decide whether an L1-provided VNCR page is mapped in L0 during TLB invalidation. The counter can result in missed TLB invalidations , and fails when an L1 vCPU invalidates its...

CVE-2026-89916 KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. Without correctly handling this, we can end up with the...

EUVD-2026-80515

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...