Description
In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Add missing srcu in kvm_s390_set_irq_state()

Like kvm_s390_inject_vcpu(), kvm_s390_set_irq_state() also needs the
kvm->srcu or the slots lock when performing the Store status operation.

Fix by taking kvm->srcu in kvm_s390_set_irq_state().
Published: 2026-10-18
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability arises from the absence of a necessary synchronization mechanism in the KVM s390 IRQ status setting function. This omission permits concurrent race conditions that can corrupt interrupt state, leading to erratic behavior, VM instability, or crashes. The weakness corresponds to improper synchronization (CWE-820).

Affected Systems

The flaw affects the Linux kernel’s KVM module on the s390 architecture. Any kernel version prior to the fix commit 7a33007b95c8908ae3980eb2b4c508f8936766df is vulnerable, and the issue is present in all Linux distributions shipping the affected kernel.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is < 1%, indicating medium severity and low exploitation probability; the vulnerability is not listed in KEV. Based on the description, it is inferred that the attack vector is local and requires privileged access to the host hypervisor. With the available data, the risk is moderate, though successful exploitation could lead to denial of service for a virtual machine.

Generated by OpenCVE AI on October 23, 2026 at 06:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest kernel update that incorporates the commit fixing the missing SRCU in kvm_s390_set_irq_state()
  • Reboot the system so the updated kernel and KVM modules become active
  • Ensure that the KVM module for the s390 architecture has reloaded with the patched code

Generated by OpenCVE AI on October 23, 2026 at 06:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-820
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 18 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() Like kvm_s390_inject_vcpu(), kvm_s390_set_irq_state() also needs the kvm->srcu or the slots lock when performing the Store status operation. Fix by taking kvm->srcu in kvm_s390_set_irq_state().
Title KVM: s390: Add missing srcu in kvm_s390_set_irq_state()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:23:21.668Z

Reserved: 2026-09-25T10:25:14.362Z

Link: CVE-2026-98652

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:18.483

Modified: 2026-10-19T10:19:29.690

Link: CVE-2026-98652

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98652 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T06:45:07Z

Weaknesses