Executive brief
A vulnerability in the Linux kernel's KVM virtualization subsystem on s390 (IBM mainframe) architecture allows memory corruption due to unsynchronized access to guest memory mapping structures. The keyop operation can race with concurrent memory limit changes, potentially leading to data corruption or a denial of service in systems running virtual machines on affected kernel versions.
Technical details
The vulnerability is a race condition in the kvm_s390_keyop() function in arch/s390/kvm/kvm-s390.c. The function reads the gmap->asce value (guest address space control element) outside of the mmu_lock read-side critical section, whereas all other similar functions (kvm_s390_get_skeys, set_skeys, get_cmma_bits, set_cmma_bits, kvm_s390_fixup_prefix, kvm_test_age_gfn, kvm_age_gfn) correctly read this value within the lock. Since gmap->asce is mutated under write_lock(mmu_lock) by gmap_set_limit(), the KVM_S390_KEYOP ioctl and KVM_S390_VM_MEM_LIMIT_SIZE operations can run concurrently and cause keyop to use a stale asce value, resulting in memory corruption. The fix moves the asce read inside the guard(read_lock)(&kvm->mmu_lock) critical section. No evidence of in-the-wild exploitation is known.
Affected products
- Linux Linux kernel multiple versions (fix applicable to stable series including 4.x, 5.x, 6.x, 7.x)
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-08-11: patched: Fix committed upstream by Christian Borntraeger
- 2026-09-11: patched: Fix merged into stable kernel tree by Greg Kroah-Hartman