CVE-2026-98652 KVM: s390: Add missing srcu in kvm_s390_set_irq_state()
A missing lock in the Linux kernel's KVM s390 module allows local attackers to trigger a race condition, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98652?
CVE-2026-98652 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Add missing srcu in kvm_s390_set_irq_state()
Like kvm_s390_inject_vcpu(), kvm_s390_set_irq_state() also needs the kvm->srcu or the slots lock when performing the Store status operation.
Fix by taking kvm->srcu in kvm_s390_set_irq_state().
Which versions are affected by CVE-2026-98652?
How do I fix CVE-2026-98652?
Apply the vendor's patch.
Is CVE-2026-98652 being exploited?
There is no known exploitation of CVE-2026-98652 in the wild and no public exploit code.
Sources
Also known as AZL-108812, BELL-CVE-2026-98652, DEBIAN-CVE-2026-98652, GHSA-q542-rw7h-r852, UBUNTU-CVE-2026-98652.