Executive brief
The Linux kernel's KVM hypervisor for IBM s390 systems contains a logic error in watchpoint configuration that allows unprivileged users with access to KVM debugging features to trigger excessive memory allocations. An attacker could cause the system to attempt allocating more than 4GB of memory, resulting in memory exhaustion warnings and potential denial of service on virtualized s390 systems.
Technical details
The vulnerability is an integer truncation and validation bypass in the `__import_wp_info()` function within the s390 KVM guest debugging code (arch/s390/kvm/guestdbg.c). User-supplied `kvm_hw_breakpoint::len` (a 64-bit value) is assigned to a 32-bit `wp_info->len` integer; the bounds check validates the truncated 32-bit value but the subsequent `kmalloc()` call uses the original untruncated 64-bit `bp_data->len`, bypassing the bounds check. This allows an attacker to request allocations exceeding MAX_WP_SIZE and MAX_PAGE_ORDER limits. The fix changes the allocation to use the validated `wp_info->len` instead. Attack vector requires local access and KVM debugging capability.
Affected products
- Linux Linux kernel all versions with s390 KVM guest debugging support (introduced in v4.something, patched in 2026-08 / 2026-09)
Timeline
- 2026-09-16: disclosed: CVE-2026-89926 published
- 2026-08-05: patched: Fix committed upstream (4c07680a467e2f7697245bcd11691bffb2a6f0ed)