CVE-2026-64369 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
s390: Revert support for DCACHE_WORD_ACCESS
load_unaligned_zeropad() reads eight bytes from unaligned addresses and may cross page boundaries. It handles exceptions which may happen if reading from the second page results in an exception.
For pages which are donated to the Ultravisor for secure execution purposes the do_secure_storage_access() exception handler however does not handle such exceptions correctly. Such an exception may result in an endless exception loop which will never be resolved.
An attempt to fix this [1] turned out to be not sufficient. For now revert
load_unaligned_zeropad() until this problem has been resolved in a proper way.
Note that the implementation of load_unaligned_zeropad() itself is correct. The revert is just a temporary workaround until there is complete fix for secure storage access exceptions.
[1] commit b00be77302d7 ("s390/mm: Add missing secure storage access fixups for donated memory")
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability resides in the s390 architecture implementation within the Linux kernel where a critical flaw exists in how unaligned memory accesses are handled when secure storage is involved. This issue specifically affects systems utilizing the Ultravisor for secure execution purposes, creating a dangerous condition that can lead to system instability and potential denial of service scenarios.
The technical flaw manifests through the load_unaligned_zeropad() function which is designed to read eight bytes from unaligned memory addresses and can cross page boundaries during normal operations. While this function itself operates correctly according to its design specifications, the problem emerges when processing exceptions that occur during secure storage access. The do_secure_storage_access() exception handler fails to properly manage these specific scenarios, creating an infinite exception loop that cannot be resolved through normal kernel mechanisms.
This vulnerability directly relates to CWE-399 which addresses Resource Management Errors and specifically targets memory management and exception handling within the kernel's virtual memory subsystem. The issue presents a clear pathway for attackers to exploit system stability by triggering conditions that lead to the problematic exception handling behavior, potentially allowing for system crashes or resource exhaustion attacks.
The operational impact of this vulnerability is significant for systems running on IBM s390 architecture with secure execution capabilities enabled through Ultravisor. When triggered, the endless exception loop can cause complete system hang conditions where the kernel becomes unresponsive and unable to process additional requests. This affects both production systems and environments that rely on secure memory handling for sensitive data protection.
The mitigation strategy implemented involves reverting the load_unaligned_zeropad() functionality as a temporary workaround until a proper fix can be developed and tested. This approach aligns with ATT&CK technique T1499.004 which addresses Resource Exhaustion and emphasizes the importance of maintaining system stability during patch development cycles. The revert ensures that systems continue to operate reliably while developers work on implementing comprehensive fixes for secure storage access exception handling.
The root cause analysis reveals that while the original implementation of load_unaligned_zeropad() was functionally correct, the integration with the secure storage subsystem created a mismatch in exception handling protocols. This demonstrates the complexity involved in maintaining compatibility between standard kernel functionality and specialized security features like Ultravisor memory protection mechanisms. The vulnerability highlights the importance of thorough testing when integrating security enhancements with core system components.
Security researchers should monitor for proper fixes that address the underlying issue in do_secure_storage_access() rather than simply reverting functions, as the temporary workaround may impact performance characteristics or eliminate legitimate use cases for unaligned memory operations. The fix must ensure proper exception handling while maintaining the security properties that Ultravisor provides for donated memory pages.
This vulnerability represents a classic example of how security features can introduce unexpected interactions when integrated with existing kernel subsystems, emphasizing the need for comprehensive testing across all system components before deploying security enhancements. The issue underscores the critical importance of maintaining system stability during security updates and demonstrates why temporary workarounds are sometimes necessary while more complete solutions are developed.
The broader implications extend beyond immediate system stability concerns to include potential data integrity issues when systems become unresponsive during secure memory operations. Organizations using s390 architecture with Ultravisor capabilities should implement monitoring for unusual exception patterns and have contingency plans in place for systems that may be affected by this vulnerability until a permanent fix is available and deployed throughout their infrastructure.
The community response to this issue demonstrates the careful balance required between security hardening and system reliability, where even well-intentioned security improvements can create unexpected operational challenges that require immediate attention and resolution through coordinated patch development efforts.