Strix
63.9K

CVE-2026-89921

Unknown

Last modified

CVE-2026-89921 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for inject_pfault_token __kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack struct kvm_s390_irq but the full ext substructure is copied into the cpu local variable on inject. ext_params and pad contain stale stack values. Interrupt delivery only uses ext_params2, so nothing leaks to the guest, but a host user can use the migration ioctls to get to the data. Fix by zero-initializing the irq struct. Do the same for the inti data structure..

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for inject_pfault_token __kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack struct kvm_s390_irq but the full ext substructure is copied into the cpu local variable on inject. ext_params and pad contain stale stack values. Interrupt delivery only uses ext_params2, so nothing leaks to the guest, but a host user can use the migration ioctls to get to the data. Fix by zero-initializing the irq struct. Do the same for the inti data structure.

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 383d0b050106abecb82f43101cac94fa423af5cd, < 9b046de62b8098af6e2ba820b125ec9dc5f162c8; >= 383d0b050106abecb82f43101cac94fa423af5cd, < 134f235e0e8de54611a72d3cc3f63e5f31246baa; >= 383d0b050106abecb82f43101cac94fa423af5cd, < 4e2c7f7cbc27418f9a290399b986c1b85ff93b90
LinuxLinux3.19

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-89921?
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for inject_pfault_token __kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack struct kvm_s390_irq but the full ext substructure is copied into the cpu local variable on inject. ext_params and pad contain stale stack values. Interrupt delivery only uses ext_params2, so nothing leaks to the guest, but a host user can use the migration ioctls to get to the data. Fix by zero-initializing the irq struct. Do the same for the inti data structure.
How severe is CVE-2026-89921?
Severity scoring for CVE-2026-89921 is pending analysis.
How do I fix CVE-2026-89921?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-89921?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST