{"id":"CVE-2026-89919","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-89919","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: keyop: use mmu_lock to read gmap->asce\n\nEvery other dat_* consumer in this file (kvm_s390_get_skeys,\nset_skeys,…","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: keyop: use mmu_lock to read gmap->asce\n\nEvery other dat_* consumer in this file (kvm_s390_get_skeys,\nset_skeys, get_cmma_bits, set_cmma_bits, MEM_CLR_CMMA,\nkvm_s390_fixup_prefix, kvm_test_age_gfn, kvm_age_gfn) reads\nkvm->arch.gmap->asce *inside* the mmu_lock read-side. keyop is the only\noutlier.\n\ngmap->asce is mutated under write_lock(mmu_lock) by gmap_set_limit()\nand keyop might use a stale asce value for walking as KVM_S390_KEYOP\nand KVM_S390_VM_MEM_LIMIT_SIZE can run concurrently. This can result\nin memory corruption.","published":"2026-09-16T10:32:14.013Z","modified":"2026-09-16T10:32:14.013Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/ae452b990e0544425f77045351c56e77158858e7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/da07a751efa4583385f9f0f47113549fe8871242"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-16T10:32:14.013Z"}}