CVE-2026-98930 KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-98930?
CVE-2026-98930 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
When __inject_sigp_stop() is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread performing the KVM_RUN IOCTL.
If the vCPU is already stopped, the status is stored immediately.
Storing the status means writing into userspace, which might fault, and __inject_sigp_stop() is called from do_inject_vcpu() which in turn is always called holding a spinlock, which is obviously an issue.
Fix this by returning -EWOULDBLOCK from __inject_sigp_stop(), and adding a bool flag to indicate whether a store status is needed. The callers of do_inject_vcpu() are modified to pass the pointer to the bool flag; whenever a Store Status operation is needed, the callers can now perform it outside the spinlock.
Opportunistically refactor kvm_s390_set_irq_state() to use scoped_guard() and __free().
[ Added Fixes tag while picking -- Claudio ]
Which versions are affected by CVE-2026-98930?
How do I fix CVE-2026-98930?
Upgrade to a fixed version.
Is CVE-2026-98930 being exploited?
There is no known exploitation of CVE-2026-98930 in the wild and no public exploit code.
Sources
Also known as AZL-110711, BELL-CVE-2026-98930, DEBIAN-CVE-2026-98930, GHSA-hqr4-mv6v-vc35, UBUNTU-CVE-2026-98930.