CVE-2026-89921 KVM: s390: Zero initialize data structures for inject_pfault_token
A local attacker with KVM access can read uninitialized kernel stack memory via migration ioctls due to missing zero-initialization in s390 fault injection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89921?
CVE-2026-89921 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Zero initialize data structures for inject_pfault_token
__kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack struct kvm_s390_irq but the full ext substructure is copied into the cpu local variable on inject. ext_params and pad contain stale stack values.
Interrupt delivery only uses ext_params2, so nothing leaks to the guest, but a host user can use the migration ioctls to get to the data.
Fix by zero-initializing the irq struct. Do the same for the inti data structure.
Which versions are affected by CVE-2026-89921?
How do I fix CVE-2026-89921?
Apply the vendor's patch.
Is CVE-2026-89921 being exploited?
There is no known exploitation of CVE-2026-89921 in the wild and no public exploit code.
Sources
Also known as AZL-101535, BELL-CVE-2026-89921, DEBIAN-CVE-2026-89921, GHSA-fm87-69w9-6w3j, UBUNTU-CVE-2026-89921.