{"id":"CVE-2026-98930","kind":"vulnerability","aliases":["CVE-2026-98930"],"related":[],"title":"Linux KVM on s390: SIGP Stop and Store Status can write to userspace under a spinlock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix IRQ injection with SIGP Stop and Store Status\n\nWhen __inject_sigp_stop() is called for a Stop and Store Status\noperation, if the vCPU is running, the interrupt is marked as pending\nand the status is stored by the thread performing the KVM_RUN IOCTL.\n\nIf the vCPU is already stopped, the status is stored immediately.\n\nStoring the status means writing into userspace, which might fault, and\n__inject_sigp_stop() is called from do_inject_vcpu() which in turn is\nalways called holding a spinlock, which is obviously an issue.\n\nFix this by returning -EWOULDBLOCK from __inject_sigp_stop(), and\nadding a bool flag to indicate whether a store status is needed. The\ncallers of do_inject_vcpu() are modified to pass the pointer to the\nbool flag; whenever a Store Status operation is needed, the callers can\nnow perform it outside the spinlock.\n\nOpportunistically refactor kvm_s390_set_irq_state() to use\nscoped_guard() and __free().\n\n[ Added Fixes tag while picking -- Claudio ]","summary":"In the Linux kernel's KVM support for IBM s390 mainframes, a Stop and Store Status request could try to write into userspace memory while holding a spinlock, which is unsafe if the write faults. The fix moves the store-status step out of the locked section.","severity":"unknown","cvss":null,"epss":0.00225,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kvm","linux-kernel","s390"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:13+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:12+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:58:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux KVM on s390: SIGP Stop and Store Status can write to userspace under a spinlock","impact":"low","summary":"In the Linux kernel's KVM support for IBM s390 mainframes, a Stop and Store Status request could try to write into userspace memory while holding a spinlock, which is unsafe if the write faults. The fix moves the store-status step out of the locked section.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","s390","kvm"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Sources give only the kernel commit text; check the NVD entry and the stable kernel releases for the fixed version and whether a guest can trigger the fault path.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000541,"input_tokens":3618,"output_tokens":358,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,21A '-98930':19A,22A 'add':190C,247C 'alreadi':139C 'alway':170C 'bool':192C,216C 'call':103C,161C,171C 'caller':203C,226C 'claudio':252C 'could':46B 'cve':17A,20A 'ewouldblock':184C 'fault':63B,155C 'fix':65B,89C,180C,248C 'flag':193C,217C 'follow':82C 'free':246C 'guard':244C 'hold':54B,172C 'ibm':37B 'immedi':145C 'indic':195C 'infrastructur':23B 'inject':91C,99C,157C,164C,186C,206C 'interrupt':117C 'ioctl':134C 'irq':90C,239C 'issu':179C 'kernel':27B,32B,80C 'kvm':2A,24B,34B,87C,132C,236C 'linux':1A,26B,31B,79C 'linux-kernel':25B 'lock':75B 'mainfram':39B 'mark':119C 'mean':149C 'memori':52B 'might':154C 'modifi':209C 'move':66B 'need':201C,224C 'obvious':177C 'oper':110C,222C 'opportunist':234C 'outsid':231C 'pass':211C 'pend':121C 'perform':130C,229C 'pick':251C 'pointer':213C 'refactor':235C 'request':45B 'resolv':86C 'return':183C 'run':115C,133C 's390':4A,28B,38B,88C,237C 'scope':243C 'section':76B 'set':238C 'sigp':5A,93C,100C,158C,187C 'spinlock':16A,56B,174C,233C 'state':240C 'status':9A,44B,70B,97C,109C,124C,142C,148C,199C,221C 'step':71B 'stop':6A,41B,94C,101C,106C,140C,159C,188C 'store':8A,43B,69B,96C,108C,126C,144C,146C,198C,220C 'store-status':68B 'support':35B 'tag':249C 'thread':129C 'tri':47B 'turn':168C 'unsaf':59B 'use':242C 'userspac':13A,51B,152C 'vcpu':113C,137C,165C,207C 'vulner':83C 'whenev':218C 'whether':196C 'write':11A,49B,62B,150C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98930","severity":null,"published_at":"2026-10-23T13:17:13+00:00","modified_at":"2026-10-23T13:17:13+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98930","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98930","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}