CVE-2026-89922

A flaw was found in the Kernel-based Virtual Machine (KVM) for the s390 architecture within the Linux kernel. A concurrency issue exists in the __import_wp_info() function when importing watchpoint data. If a memory slot update occurs concurrently without the required locks being held, the memory slot array can be prematurely freed. This could lead to memory corruption, potentially causing system instability or a denial of service.

KVM s390 guest debug watchpoint import can access guest memory through kvm_read_guest without holding kvm srcu. A concurrent memslot update can free the memslots array after the SRCU grace period while the import path still resolves or uses the old memslot data, creating a race based use-after-free candidate in KVM memory slot handling. For the CVSS the PR:L is used because a local user or service with access to /dev/kvm and control of the VM debug ioctls can reach the affected path without needing full host root in many deployments. The issue is not network reachable and requires local KVM access plus a timing race with memslot updates.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.