CVE-2026-89919

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-89919

Key Details

CVE	CVE-2026-89919
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: keyop: use mmu_lock to read gmap->asce

Every other dat_* consumer in this file (kvm_s390_get_skeys,

set_skeys, get_cmma_bits, set_cmma_bits, MEM_CLR_CMMA,

kvm_s390_fixup_prefix, kvm_test_age_gfn, kvm_age_gfn) reads

kvm->arch.gmap->asce *inside* the mmu_lock read-side. keyop is the only

outlier.

gmap->asce is mutated under write_lock(mmu_lock) by gmap_set_limit()

and keyop might use a stale asce value for walking as KVM_S390_KEYOP

and KVM_S390_VM_MEM_LIMIT_SIZE can run concurrently. This can result

in memory corruption. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-89919
CVE	https://www.cve.org/CVERecord?id=CVE-2026-89919

Source

Reference

NVD

CVE