Executive brief
A flaw in the Linux kernel's KVM virtualization layer on IBM s390 systems could allow channel-subsystem damage machine checks to be improperly forwarded to guest virtual machines, causing memory corruption. Since guest channel subsystems are emulated in user space, these host-level machine checks should not be injected into guests. An attacker with ability to trigger machine checks could corrupt memory or cause system instability.
Technical details
The vulnerability is a logic error in KVM's s390 machine check injection code (arch/s390/kvm/interrupt.c). Channel-subsystem damage machine checks (indicated by the CK bit in the machine check interruption code) are host-level conditions meant for the host channel subsystem. However, the code was reinjecting these checks into guest virtual machines, which have only an emulated channel subsystem managed by the user-space hypervisor. This caused improper memory handling, including potential use-after-free (kfree of a stack variable). The fix masks out the CK bit along with CP and EXT_DAMAGE bits when backing up and reinjecting machine check information, preventing these host-specific checks from being forwarded to guests. No special privileges or guest interaction is required; the vulnerability is triggered by legitimate hardware machine check conditions.
Affected products
- Linux Linux kernel Multiple versions from 4.x through 7.x on IBM s390 systems
Timeline
- 2026-09-16: disclosed
- 2026-08-11: patched: Fix commit 546dde823a36d7283dcf46127c2f3d093443860f merged into stable branches