PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-98930 Linux CVE debrief

A Linux kernel vulnerability was resolved, addressing an issue with IRQ injection in KVM: s390 when using SIGP Stop and Store Status operations. The problem arose when __inject_sigp_stop() was called for a Stop and Store Status operation. If the vCPU was running, the interrupt was marked as pending and the status stored by the thread performing the KVM_RUN IOCTL. However, if the vCPU was already stopped, the status was stored immediately. Storing the status involves writing into userspace, which might fault. The issue was that __inject_sigp_stop() was called from do_inject_vcpu(), always holding a spinlock, causing a potential issue. The fix involves returning -EWOULDBLOCK from __inject_sigp_stop() and adding a bool flag to indicate whether a store status is needed.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-23
Advisory published
2026-10-23
Advisory updated
2026-10-23

Who should care

Defenders responsible for Linux kernel and KVM: s390 configurations should assess exposure and prioritize verification and remediation. This includes operators managing Linux-based systems, platform administrators overseeing KVM: s390 deployments, vulnerability management teams reviewing system configurations, and security teams ensuring that updates are applied and compensating controls are in place.

Why it matters

The vulnerability requires verification and remediation to prevent potential issues with IRQ injection in KVM: s390. Defenders should prioritize updating to the latest kernel version and reviewing system configurations.

  • Defenders must verify Linux kernel versions to ensure the fix is applied.
  • System configurations for KVM: s390 require review to prevent potential issues.
  • Updating to the latest kernel version is necessary to address the vulnerability.
  • Ensuring KVM: s390 is properly configured is crucial to prevent exploitation.

Technical summary

The Linux kernel vulnerability CVE-2026-98930 addresses an issue with IRQ injection in KVM: s390 when using SIGP Stop and Store Status operations. The fix involves returning -EWOULDBLOCK from __inject_sigp_stop() and adding a bool flag to indicate whether a store status is needed. This change allows for storing the status outside the spinlock, preventing potential faults. Defenders should prioritize verifying the Linux kernel version and applying the fix to prevent potential issues with IRQ injection in KVM: s390. This requires reviewing system configurations, updating to the latest kernel version, and ensuring that KVM: s390 is properly configured.

Defensive priority

Defenders should prioritize verifying the Linux kernel version and applying the fix to prevent potential issues with IRQ injection in KVM: s390. This requires reviewing system configurations, updating to the latest kernel version, and ensuring that KVM: s390 is properly configured.

Recommended defensive actions

  • Verify Linux kernel version and apply the fix
  • Review system configurations for KVM: s390
  • Update to the latest kernel version
  • Ensure KVM: s390 is properly configured
  • Perform vulnerability scanning to identify potentially affected systems
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability and its resolution. However, the corpus does not establish specific versions, exploitation, impact, or remediation beyond the provided information, requiring verification from official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-98930 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-98930

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-98930 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-98930

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • KVM: s390: Fix IRQ injection with SIGP Stop and Store Status

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98930.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3bd77c59576b1d447fd56cc689ae9523a334b924

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a379ac504fcb8c6fc2aa36203f5489b9581eb2e0

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d0e3bf633f0585a0c2c2105ea7723777d764fae5

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d343407b728a80b74be3c24b59f15e60289ea527

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.