Linux Kernel up to 7.2.5 s390 integer overflow

Summaryinfo

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 7.2.5. The affected element is an unknown function of the component s390. The manipulation results in integer overflow. This vulnerability is identified as CVE-2026-93147. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.2.5. Affected is an unknown functionality of the component s390. The manipulation with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpu_nr is a 32 bit value and BPF_REG_0 is a 64 bit register, when ly loads the cpu_nr into BPF_REG_0 it does not zero the upper bits, but llgf does.

The advisory is available at git.kernel.org. This vulnerability is traded as CVE-2026-93147 since 09/17/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 09/17/2026).

Upgrading to version 7.2.6 or 7.3-rc1 eliminates this vulnerability. Applying the patch 88500a86ab79f01c568de6ed00f5b1c5c79f11d5/5f6cc299938b561cb01e343bab7042611fcee12a is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion