CVE-2026-72291 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix unlikely race in try_get_locked_pte()
Fix an unlikely race in try_get_locked_pte(), which could have happened if puds or pmds get unmapped between the p?dp_get() and p?d_offset() functions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's KVM subsystem on s390 architecture represents a subtle but significant race condition within the memory management subsystem that could potentially lead to system instability or security implications. This flaw specifically affects the virtualization capabilities of IBM System/390 mainframe systems when running Linux guests through KVM hypervisor implementations. The issue manifests in the try_get_locked_pte() function which is responsible for managing page table entries during memory translation processes.
The technical flaw occurs when the kernel attempts to traverse page table structures to locate specific page table entries, particularly when dealing with puds (page upper directory) or pmds (page middle directory). The race condition emerges from a timing window where memory mappings can be altered between two critical function calls - p?dp_get() and p?d_offset(). During this window, page table entries may become unmapped or modified by concurrent operations, leading to potential dereference of invalid memory addresses or incorrect memory access patterns. This type of race condition falls under the broader category of concurrent programming errors that can result in undefined behavior within kernel space operations.
The operational impact of this vulnerability extends beyond simple system instability into potential security implications for virtualized environments where multiple guests may be running concurrently on the same physical s390 system. When the race condition occurs, it could lead to memory corruption, guest operating system crashes, or potentially allow malicious code to exploit the inconsistent page table state. The vulnerability is classified as unlikely due to the specific timing requirements needed for the race to manifest, but its presence in kernel space makes it particularly dangerous since any exploitation could affect the entire host system. This issue directly relates to CWE-362, which describes concurrent execution using shared data structures without proper synchronization mechanisms.
The fix implemented addresses this race condition by ensuring proper locking mechanisms are maintained throughout the page table traversal process, preventing the scenario where mappings become invalid between the initial lookup and subsequent offset calculations. This remediation aligns with established best practices for kernel memory management and follows the ATT&CK framework's approach to mitigating privilege escalation and system stability threats through proper synchronization primitives. Organizations running KVM virtualization on s390 systems should prioritize applying this patch to maintain system integrity and prevent potential exploitation of the race condition. The resolution demonstrates the importance of careful consideration of concurrent access patterns in kernel-level memory management functions, particularly in virtualized environments where multiple processes may be accessing shared memory structures simultaneously.