CVE-2026-89926
KVM: s390: Fix length check __import_wp_info()
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check __import_wp_info() struct kvm_hw_breakpoint::len is a __u64 that is fully controlled by user space. This is then assigned to wp_info->len, which is an int. The bounds check is done on the truncated value while the allocation uses the untruncated one: wp_info->len = bp_data->len; [...] if (wp_info->len < 0 || wp_info->len > MAX_WP_SIZE) return -EINVAL; wp_info->old_data = kmalloc(bp_data->len, GFP_KERNEL_ACCOUNT); Use the validated value for the allocation as intended. Without this fix userspace can trigger >4GB allocations which will fail and result in a WARN due to MAX_PAGE_ORDER.
INFO
Published Date :
Sept. 16, 2026, 11:17 a.m.
Last Modified :
Sept. 16, 2026, 11:17 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Apply the vendor patch for KVM on s390.
- Validate input length before memory allocation.
- Ensure allocation sizes do not exceed MAX_PAGE_ORDER.
- Update the Linux kernel to the patched version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-89926.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-89926 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-89926
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-89926 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-89926 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 16, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check __import_wp_info() struct kvm_hw_breakpoint::len is a __u64 that is fully controlled by user space. This is then assigned to wp_info->len, which is an int. The bounds check is done on the truncated value while the allocation uses the untruncated one: wp_info->len = bp_data->len; [...] if (wp_info->len < 0 || wp_info->len > MAX_WP_SIZE) return -EINVAL; wp_info->old_data = kmalloc(bp_data->len, GFP_KERNEL_ACCOUNT); Use the validated value for the allocation as intended. Without this fix userspace can trigger >4GB allocations which will fail and result in a WARN due to MAX_PAGE_ORDER. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/89xxx/CVE-2026-89926.json">CVE-2026-89926</a> Added Reference https://git.kernel.org/stable/c/3fe801db90bdeefb0bbdda42d832846b53f64f8a Added Reference https://git.kernel.org/stable/c/4c07680a467e2f7697245bcd11691bffb2a6f0ed Added Reference https://git.kernel.org/stable/c/71153d3262517e1c02c3a66aa5094f279b2d1454 Added Reference https://git.kernel.org/stable/c/aef540194effd768bed0bd2e6a74fe135a3d7c3a Added Reference https://git.kernel.org/stable/c/b94ab9caa5d72c78226121cccff5e33f946da900 Added Reference https://git.kernel.org/stable/c/beb9c55af609c4c7308259d7191688c75a4e3d4a Added Reference https://git.kernel.org/stable/c/fec89d327d9b2b669b5bbdac209386c6317c3722