CVE-2026-89926

A flaw was found in the Linux kernel's KVM s390 component. A local user can exploit this vulnerability by providing a specially crafted length value to the hardware breakpoint (kvm_hw_breakpoint) mechanism. This integer truncation can lead to an attempted allocation of over 4GB of memory, causing the system to issue a warning and potentially resulting in a denial of service (DoS).

This vulnerability is rated as Low severity because exploitation is restricted to IBM Z (s390x) architectures running KVM virtualization, and the oversized allocation failure triggers a kernel warning rather than arbitrary memory corruption or an immediate host crash. On typical Red Hat Enterprise Linux installations, interaction with the virtual machine control endpoints requires administrative privileges or membership in authorized hypervisor groups. Unprivileged local accounts cannot reach the affected guest debugging interfaces under default access controls, which severely restricts potential operational exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.