Kernel Vulnerability in Linux Package: Zero Initialization Flaw in KVM for s390 Architecture
Summary
DEBIAN-CVE-2026-89921: In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for inject_pfault_token __kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack st... Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services for software applications. It supports a wide range of architectures, including s390, which is used in IBM mainframes. This vulnerability affects the KVM (Kernel-based Virtual Machine) subsystem, specifically in the handling of interrupt requests, which can lead to potential data exposure.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the KVM subsystem for the s390 architecture. The function __kvm_inject_pfault_token() fails to fully initialize the on-stack struct kvm_s390_irq, leading to the copying of stale stack values into the cpu local variable. While the interrupt delivery mechanism only utilizes ext_params2, which does not leak data to the guest, a host user can exploit this flaw through migration ioctls to access sensitive data. This oversight poses a risk of information leakage, potentially compromising the security of the host system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The vulnerability in the Linux kernel's KVM subsystem for the s390 architecture poses a risk of information leakage due to improper initialization of data structures. It is essential for users to update their systems to the latest patched versions to safeguard against potential exploits.
See every vulnerability recorded for linux →
FAQ
The vulnerability can potentially allow a host user to access sensitive data through migration ioctls, posing a risk of information leakage.
If you are using the Linux kernel on Debian 12, 13, or 14, it is advisable to check for updates and apply them to mitigate the risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is crucial to prioritize updating your system to mitigate the risk as soon as possible.
Detailed information can be found in the official Debian security advisories and the CVE database.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
