CVE-2026-89921 Linux CVE debrief

Who should care

Linux kernel maintainers, KVM administrators, and security teams responsible for Linux-based virtualization infrastructure should assess exposure and prioritize remediation. This includes verifying Linux kernel versions and KVM configurations, reviewing system migration ioctls restrictions, and applying Linux kernel updates addressing CVE-2026-89921. Additionally, they should perform vulnerability assessments and inventory affected systems for remediation.

Why it matters

CVE-2026-89921 is a Linux kernel vulnerability that allows a host user to access sensitive data through migration ioctls. Although guest data remains secure, Linux kernel maintainers, KVM administrators, and security teams should assess exposure and prioritize remediation. The issue is resolved in the Linux kernel, and four source references provide details on the specific commits that address the issue.

• Host users can access sensitive data through migration ioctls
• Requires verification of Linux kernel versions and KVM configurations
• Remediation involves applying Linux kernel updates
• Exposure assessment is necessary for Linux-based virtualization infrastructure

Technical summary

The __kvm_inject_pfault_token() function in the Linux kernel does not fully initialize the on-stack struct kvm_s390_irq, leading to sensitive data exposure through migration ioctls. The issue is resolved by zero-initializing the irq struct. This vulnerability allows a host user to access sensitive data, although guest data remains secure. Linux kernel maintainers, KVM administrators, and security teams should assess exposure and prioritize remediation for Linux kernel deployments using KVM on s390 architectures, focusing on verifying system migration ioctls restrictions and applying Linux kernel updates.

Defensive priority

Assess exposure and prioritize remediation for Linux kernel deployments using KVM on s390 architectures.

Recommended defensive actions

• Assess Linux kernel versions and KVM configurations for potential exposure
• Verify system migration ioctls are properly restricted
• Review and apply Linux kernel updates addressing CVE-2026-89921
• Monitor system logs for suspicious migration ioctl activity
• Perform vulnerability assessment for Linux-based virtualization infrastructure
• Inventory and track affected systems for remediation prioritization
• Review compensating controls for exposed systems while remediation is scheduled

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, which is resolved in the Linux kernel. Four source references are provided, detailing the specific commits that address the issue. To verify, defenders should review Linux kernel versions and KVM configurations for potential exposure, and assess the migration ioctls restrictions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.