Executive brief
A virtualization hypervisor (KVM) on IBM s390 systems fails to initialize memory structures before use, leaving stale stack data in interrupt handling buffers. While guest systems cannot access this leaked data directly, a host user with migration privileges can extract the uninitialized memory through migration ioctls, potentially exposing sensitive kernel information.
Technical details
The vulnerability exists in the KVM s390 implementation's __kvm_inject_pfault_token() function. Two stack-allocated data structures (kvm_s390_irq and kvm_s390_interrupt) are declared without initialization, leaving their memory contents uninitialized. While the function only sets specific fields (.type and .u.ext.ext_params2), the full ext substructure is later copied to CPU-local storage during interrupt injection. Stale stack values in ext_params and pad fields persist in kernel memory. An authenticated local user with access to KVM migration ioctls can read this uninitialized memory, leaking kernel stack contents. The fix initializes both data structures with zero values using C99 empty initializer syntax (inti = {}, irq = {}).
Affected products
- Linux Linux Kernel multiple versions (s390/KVM subsystem)
Timeline
- 2026-09-16: disclosed
- 2026-08-05: patched