SB20260815316 - Improper control of a resource through its lifetime in Linux kernel s390 mm

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72412)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause guest memory corruption.

The vulnerability exists due to improper state management in s390 page table entry handling when updating present ptes for guest memory mappings. A local user can trigger page table updates involving reused guest pages to cause guest memory corruption.

The issue affects KVM on s390 systems where the _PAGE_UNUSED bit can remain set after a page becomes used again.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/d4bb00704a66024502261fa7a523c07420249fea
• https://git.kernel.org/stable/c/fda07c8e4b54b9105f1ca73f0adea7b244d405f4