From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792758213; b=2UMQ/e+WlFbIZJ63dPFHiqD9/01v+r2tHeQTwbw404lKYcM0S92GWG4qpwiebvZ+Vr9F PKpL1wVIHPj0xT6S9/Wuwn5qpkwO0/ru10bzu67go7zT/RJZoGoGaDrsSsGFdZ2khI94u 89VpA5SgJcc9X4X29pxhaJmTLhesozpnWpSs4s7YqOkc4fXdbDmmLQMxQXI7+0V5LXQzD U+CDdEuRz8SSRA3tOKrnVjBjufEopfi1dxMSOMtv0ZvFsySUleki7Yty78xeLOXX9ETCG WiCjPj21J9io+ZCsve8UGTp98FPB6eXegbnsL9SiqSKT1LycaDjDbyF8rMc+OBrWmjg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792758213; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: Reply-To:MIME-Version:Lines:X-Developer-Signature:X-Developer-Key: Content-Transfer-Encoding; bh=rtc/ELzqqQScED5z45aIB5oU1NFW+/eUzcavJGGgNvI=; b=CQJY7WH9Mxqk1BEiEaz1CgkCzw1diUxNt16s5aYCZI1Wv3FYXufJuNp4icMyBYsqB7+C JTWZKwIZNW+ds4pTRwJKG8ROlW7JK7JvagxTmwQOEKmWR3UsxTdqiyzTBEVfAVVWSZYVq xuXJXtrzSFlIzYop1jmsmjc7joDq6yFPgm6upuHl4iexKYz1oQbeWBcGTHGiIcvYM+LU3 o4Va1zbuibQ5YygEmLPLfsQa1S1ZJUKQGUyZujAdX3dW61xifiaYFlJ+Kmzo0lIpeddri rNB1nGn/28RVhIdqnSeHZw5oziq2QkuiClIClIwbZXiNTZRlDgnQqwxfOdBeIwjyq7w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=tnBGWQ+L; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A4C2606A31A for ; Fri, 23 Oct 2026 12:23:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=tnBGWQ+L Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4CC881F01825; Fri, 23 Oct 2026 12:23:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792758213; bh=rtc/ELzqqQScED5z45aIB5oU1NFW+/eUzcavJGGgNvI=; h=From:To:Cc:Subject:Date:Reply-To; b=tnBGWQ+LEfATx9lVnwGa5ZZrO1MuV9NSsneP+4ugG7Xzc2XRvAgZuRwaJrAGFEhNC xJ7S83eovXhGNH7y8dFMCeLZwtcfRjy+R8lAGcwbxfETc+Wg/BdTcN/xweFOl/CU3N +31XO2LRH5AWN8O7rvJIlRTjIrVHH+lwKaYeHyac= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98930: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status Date: Fri, 23 Oct 2026 14:08:25 +0200 Message-ID: <2026102322-CVE-2026-98930-8bee@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3164; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=aG8t5hkJKaoL5JKHYDUV18teM4q7pJs47S/bFxOXjX0=; b=owGbwMvMwCRo6H6F97bub03G02pJDFm3/cz3djXaV1bUGL1iuRNXdTImcPUWuU8pdz+Hq0+5u NeCO25+RywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAExE7xHDgh0/pr1nnpQdeMZv 6Yy34sqeSrqKCQxzuHJd/dtCvptuv9tX4GT2tEz39rVyAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When __inject_sigp_stop() is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread performing the KVM_RUN IOCTL. If the vCPU is already stopped, the status is stored immediately. Storing the status means writing into userspace, which might fault, and __inject_sigp_stop() is called from do_inject_vcpu() which in turn is always called holding a spinlock, which is obviously an issue. Fix this by returning -EWOULDBLOCK from __inject_sigp_stop(), and adding a bool flag to indicate whether a store status is needed. The callers of do_inject_vcpu() are modified to pass the pointer to the bool flag; whenever a Store Status operation is needed, the callers can now perform it outside the spinlock. Opportunistically refactor kvm_s390_set_irq_state() to use scoped_guard() and __free(). [ Added Fixes tag while picking -- Claudio ] The Linux kernel CVE team has assigned CVE-2026-98930 to this issue. Affected and fixed versions =========================== Issue introduced in 4.0 with commit 6cddd432e3da5e25eccbc13844d03c871674a62e and fixed in 6.12.112 with commit 3bd77c59576b1d447fd56cc689ae9523a334b924 Issue introduced in 4.0 with commit 6cddd432e3da5e25eccbc13844d03c871674a62e and fixed in 6.18.55 with commit a379ac504fcb8c6fc2aa36203f5489b9581eb2e0 Issue introduced in 4.0 with commit 6cddd432e3da5e25eccbc13844d03c871674a62e and fixed in 7.2.9 with commit d0e3bf633f0585a0c2c2105ea7723777d764fae5 Issue introduced in 4.0 with commit 6cddd432e3da5e25eccbc13844d03c871674a62e and fixed in 7.3 with commit d343407b728a80b74be3c24b59f15e60289ea527 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98930 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/s390/kvm/interrupt.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3bd77c59576b1d447fd56cc689ae9523a334b924 https://git.kernel.org/stable/c/a379ac504fcb8c6fc2aa36203f5489b9581eb2e0 https://git.kernel.org/stable/c/d0e3bf633f0585a0c2c2105ea7723777d764fae5 https://git.kernel.org/stable/c/d343407b728a80b74be3c24b59f15e60289ea527