Use of Uninitialized Variable in Linux kernel - CVE-2026-89921

Vulnerability identifier: #VU150360

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-89921

CWE-ID: CWE-457

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized stack data structures in __kvm_inject_pfault_token() when using migration ioctls after page-fault token injection. A local user can retrieve stale stack values to disclose sensitive information.

The stale values are not exposed to the guest through interrupt delivery.

Linux kernel
Debian Linux
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux (Debian package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17
linux (Debian package) - update to 6.12.113-1

• https://git.kernel.org/stable/c/134f235e0e8de54611a72d3cc3f63e5f31246baa
• https://git.kernel.org/stable/c/4e2c7f7cbc27418f9a290399b986c1b85ff93b90
• https://git.kernel.org/stable/c/9b046de62b8098af6e2ba820b125ec9dc5f162c8

• Use of Uninitialized Variable in Linux kernel s390 kvm
• Debian update for linux
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more