CVE-2026-89921

A flaw was found in the Kernel-based Virtual Machine (KVM) for the s390 architecture in the Linux kernel. The __kvm_inject_pfault_token() function fails to fully zero-initialize certain data structures, specifically struct kvm_s390_irq. This oversight allows stale stack values to persist in the ext_params and pad fields. A local host user could exploit this by using migration input/output controls (ioctls) to access this uninitialized data, leading to information disclosure.

KVM s390 pfault token injection used on stack interrupt structures without full zero initialization. Only selected fields were set, while the larger ext state copied for injection could retain stale kernel stack values in ext_params or padding. Interrupt delivery to the guest uses ext_params2, so the direct guest delivery path is not the leak path. A local host user with access to KVM migration ioctls can retrieve the affected state and may observe stale kernel stack data. For the CVSS the PR:L is used because triggering and reading the data requires a local host user or VM management process with access to KVM migration ioctls, not full host root privileges. The issue is not network reachable by itself. Impact is primarily confidentiality loss. The base score uses C:L due to the limited exposed data, while the paranoid score uses C:H because kernel stack disclosure can expose sensitive values or pointers and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.