HIGH Introduced in 3.16
kvm WatchpointImport UAF
CVE-2026-89922
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data __import_wp_info() backs up the original guest memory contents of a watchpoint with read_guest_abs(), which is kvm_read_guest() and therefore resolves the memslot via __kvm_memslots(). That requires kvm->srcu (or kvm->slots_lock) to be held, otherwise a concurrent memslot update can free the memslots array under us once its SRCU grace period has elapsed. As this is not fast path, following lock ordering (mutex first, then srcu) take the big hammer and hold the srcu for the full import.
02KernelScan AI Analysis
Risk summary
A race condition in KVM s390 watchpoint import allows a concurrent memslot update to free the memslots array while it is still being accessed, leading to a use-after-free. A local user with access to a KVM s390 guest can trigger this by setting guest debug watchpoints while concurrently updating memory slots, potentially resulting in kernel memory corruption. This affects systems running KVM on s390 architecture with guest debugging enabled.
Vulnerability analysis
When setting up hardware watchpoints for guest debugging, the host kernel reads guest memory to preserve the original data at the watchpoint location. This operation looks up the memory slot in a protected table, but the watchpoint setup path failed to acquire the necessary read lock. A concurrent update to the guest's memory mappings could then free that table while the watchpoint setup was still using it, causing a use-after-free. The fix holds the proper read lock for the entire watchpoint import so the table cannot be freed mid-operation. The flaw is reachable from userspace through the guest-debugging interface on an s390 KVM virtual CPU, requiring only access to the virtual-machine file descriptor.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 3.16 | 6.1.188 | 6830fbc3724b |
| 6.12 | 3.16 | 6.12.110 | 76f5b4ea9ed0 |
| 6.18 | 3.16 | 6.18.51 | cc710ee45395 |
| 6.6 | 3.16 | 6.6.157 | f8e3a9997d5e |
| 7.2 | 3.16 | 7.2.5 | 4c05bf21d180 |
| mainline | 3.16 | 7.3 | a4e482def853 |
| cip/6.1 | 3.16 | 6.1.189-cip61 | 6830fbc3724b |
| cip/6.1-rt | 3.16 | 6.1.189-cip61-rt32 | 6830fbc3724b |
| cip/6.12 | 3.16 | 6.12.111-cip32 | 76f5b4ea9ed0 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |