CVE-2026-89921 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Zero initialize data structures for inject_pfault_token
__kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack struct kvm_s390_irq but the full ext substructure is copied into the cpu local variable on inject. ext_params and pad contain stale stack values.
Interrupt delivery only uses ext_params2, so nothing leaks to the guest, but a host user can use the migration ioctls to get to the data.
Fix by zero-initializing the irq struct. Do the same for the inti data structure.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel contains an information disclosure vulnerability within the KVM s390 subsystem related to the initialization of interrupt request structures during virtual machine operations. Specifically, the function __kvm_inject_pfault_token() is responsible for constructing a kvm_s390_irq structure on the stack before injecting it into the guest environment. However, this implementation only explicitly initializes two specific fields: .type and .u.ext.ext_params2. The remainder of the extended interrupt substructure, which includes ext_params and pad members, remains uninitialized. In C programming, local variables that are not fully initialized retain whatever data previously existed in those memory locations on the stack. This creates a scenario where stale kernel heap or stack data is inadvertently included in the structure being processed by the virtualization layer.
From an operational perspective, this flaw does not result in immediate guest-side information leakage because the interrupt delivery mechanism for s390 architecture exclusively utilizes the ext_params2 field. The uninitialized fields are effectively ignored during standard execution flows within the guest OS. Consequently, a malicious or compromised guest cannot directly exploit this to read sensitive host memory through normal instruction execution paths. However, the vulnerability becomes critical when considering administrative interfaces and live migration capabilities. Host-level users with appropriate privileges can interact with the KVM interface using specific ioctls designed for virtual machine state migration. These mechanisms often serialize the entire interrupt request structure or related internal states for transfer between hosts. Because the struct contains uninitialized memory regions containing potentially sensitive kernel data, this stale information is exposed to any entity capable of accessing these migration endpoints.
This vulnerability aligns with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and falls under the category of improper initialization leading to information leakage. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1537: Transfer Data to Cloud Account or similar data exfiltration techniques where internal state is transferred externally without proper sanitization. The root cause lies in a failure to adhere to secure coding practices regarding memory management, specifically the assumption that partial initialization is sufficient for structures that are subsequently copied or serialized by higher-level system components.
To mitigate this vulnerability, it is essential to ensure that all data structures passed through virtualization interfaces are fully zero-initialized before use. The primary fix involves modifying __kvm_inject_pfault_token() to explicitly clear the entire kvm_s390_irq structure using functions such as memset or designated initializers at declaration time. This practice must be extended to other similar interrupt injection routines, including those handling inti data structures, to prevent consistent patterns of uninitialized memory exposure. System administrators should apply kernel updates that include this patch immediately. Additionally, organizations relying on live migration features for s390 virtual machines should verify their host systems are running patched kernels to prevent potential leakage of sensitive internal state during VM movement operations across different physical hosts.