HIGH Introduced in 7.0
kvm KeyOp Race
CVE-2026-89919
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: keyop: use mmu_lock to read gmap->asce Every other dat_* consumer in this file (kvm_s390_get_skeys, set_skeys, get_cmma_bits, set_cmma_bits, MEM_CLR_CMMA, kvm_s390_fixup_prefix, kvm_test_age_gfn, kvm_age_gfn) reads kvm->arch.gmap->asce *inside* the mmu_lock read-side. keyop is the only outlier. gmap->asce is mutated under write_lock(mmu_lock) by gmap_set_limit() and keyop might use a stale asce value for walking as KVM_S390_KEYOP and KVM_S390_VM_MEM_LIMIT_SIZE can run concurrently. This can result in memory corruption.
02KernelScan AI Analysis
Risk summary
A local process with access to KVM s390 ioctls can exploit a race condition between storage-key operations and memory-limit changes to corrupt host kernel memory. The corruption is attacker-influenced and can lead to information disclosure, arbitrary writes, or a kernel panic. This requires s390 architecture with KVM support and the ability to issue concurrent KVM ioctls.
Vulnerability analysis
A race condition exists in the KVM s390 storage-key operation handler. The handler fetches a memory-management configuration value before ensuring exclusive access, while a concurrent operation that changes memory limits can update that same value. The storage-key handler can then use a stale configuration when walking page tables, corrupting host kernel memory. The fix ensures the value is fetched only after proper synchronization, so it stays consistent with any concurrent limit change. The vulnerability is reachable locally by any process that holds a KVM VM file descriptor and can issue the storage-key and memory-limit ioctls concurrently; it is specific to the s390 architecture with KVM enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.5 | ae452b990e05 |
| mainline | 7.0 | 7.3-rc1 | da07a751efa4 |