Live › vulnerability › CVE-2026-98930
Go to dashboardIn the Linux kernel's KVM support for IBM s390 mainframes, a Stop and Store Status request could try to write into userspace memory while holding a spinlock, which is unsafe if the write faults. The fix moves the store-status step out of the locked section.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
When __inject_sigp_stop() is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread performing the KVM_RUN IOCTL.
If the vCPU is already stopped, the status is stored immediately.
Storing the status means writing into userspace, which might fault, and __inject_sigp_stop() is called from do_inject_vcpu() which in turn is always called holding a spinlock, which is obviously an issue.
Fix this by returning -EWOULDBLOCK from __inject_sigp_stop(), and adding a bool flag to indicate whether a store status is needed. The callers of do_inject_vcpu() are modified to pass the pointer to the bool flag; whenever a Store Status operation is needed, the callers can now perform it outside the spinlock.
Opportunistically refactor kvm_s390_set_irq_state() to use scoped_guard() and __free().
[ Added Fixes tag while picking -- Claudio ]
This page as .md · .json · in your agent: get_signal("CVE-2026-98930")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.