CVE-2026-89920

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) s390 component. This vulnerability arises from the incorrect reinjection of channel-subsystem damage machine checks into the guest virtual machine, which are intended for the host system. This misdirection can lead to memory corruption by attempting to free a stack variable. The issue is resolved by properly masking out the CK bit during machine check information backup.

KVM/s390 machine check reinjection can lead to host kernel memory corruption because CK channel-subsystem machine checks were incorrectly treated as guest deliverable events. The vulnerable path could pass a stack allocated kvm_s390_interrupt_info object into the VM wide injection path and later code may attempt kfree() on that non heap object, which can corrupt kernel memory or crash the host. For the CVSS the PR:L because an attacker would typically need the ability to run or control a KVM guest or VMM context on the host, but not full host root in common delegated virtualization setups. The issue is not network reachable by packet traffic and requires a s390 KVM environment plus a relevant machine check condition, so AC:H is used. Impact is at least denial of service via host crash and in worst case may allow confidentiality or integrity impact due to kernel memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.