Missing Synchronization in Linux kernel - CVE-2026-98652

Vulnerability identifier: #VU156965

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98652

CWE-ID: CWE-820

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to potentially cause a denial of service through unsynchronized access to virtual machine state.

The vulnerability exists due to missing synchronization in the Linux kernel KVM s390 function kvm_s390_set_irq_state() when performing the store status operation without holding the required SRCU protection or slots lock. A local user can trigger store status processing during concurrent changes to virtual machine state to potentially cause invalid memory access and disrupt kernel operation.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/7a33007b95c8908ae3980eb2b4c508f8936766df
• https://git.kernel.org/stable/c/f3a557067d57ce6ae98d485c8009b223e16f5f36

• Missing Synchronization in Linux kernel kvm s390
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more