SB20261022239 - Missing Synchronization in Linux kernel kvm s390

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Synchronization (CVE-ID: CVE-2026-98652)

CWE-ID: CWE-820 - Missing Synchronization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through unsynchronized access to virtual machine state.

The vulnerability exists due to missing synchronization in the Linux kernel KVM s390 function kvm_s390_set_irq_state() when performing the store status operation without holding the required SRCU protection or slots lock. A local user can trigger store status processing during concurrent changes to virtual machine state to potentially cause invalid memory access and disrupt kernel operation.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/7a33007b95c8908ae3980eb2b4c508f8936766df
• https://git.kernel.org/stable/c/f3a557067d57ce6ae98d485c8009b223e16f5f36