HIGH Introduced in 4.13
kvm MachineCheck Corruption
CVE-2026-89920
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in forwarding such machine checks into the guest. This also simplifies the machine check reinjection and avoids kfree of a stack variable as reported by sashiko. There might be still machine checks that have the ck bit set with another bit (like instruction damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and ED bits already are.
02KernelScan AI Analysis
Risk summary
An s390 KVM host can suffer kernel heap corruption when a channel-subsystem damage machine check occurs during guest execution. The corruption stems from freeing a stack-allocated interrupt descriptor as if it were heap memory. Products running KVM on s390 hardware with active guests are at risk; the host kernel may crash or be compromised, affecting all co-located tenants.
Vulnerability analysis
When a channel-subsystem damage machine check occurs during guest execution on an s390 KVM host, the reinjection path places an interrupt descriptor on the stack and passes it to the floating interrupt delivery mechanism, which later treats it as heap memory and frees it. This corrupts the host kernel heap by freeing a stack address. The fix removes the stack-based code path entirely, always using the per-vCPU injection path with a properly managed structure. It also masks out the channel-subsystem damage bit when saving machine check information so these host-only events are no longer forwarded into the guest. This affects s390 systems running KVM with active guests and is triggered by a hardware machine check interrupt during guest execution, resulting in host kernel memory corruption.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 4.13 | 6.12.114 | b7631982fb65 |
| 6.18 | 4.13 | 6.18.51 | 6ee52d3af2a1 |
| 6.6 | 4.13 | 6.6.160 | 5c63e2ed840c |
| 7.2 | 4.13 | 7.2.5 | 7077ec953996 |
| mainline | 4.13 | 7.3 | 546dde823a36 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |