{"id":"CVE-2026-89926","summary":"KVM: s390: Fix length check __import_wp_info()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix length check __import_wp_info()\n\nstruct kvm_hw_breakpoint::len is a __u64 that is fully controlled by user\nspace. This is then assigned to wp_info-\u003elen, which is an int. The bounds\ncheck is done on the truncated value while the allocation uses the\nuntruncated one:\n\n\twp_info-\u003elen = bp_data-\u003elen;\n\t[...]\n\tif (wp_info-\u003elen \u003c 0 || wp_info-\u003elen \u003e MAX_WP_SIZE)\n\t\treturn -EINVAL;\n\n\twp_info-\u003eold_data = kmalloc(bp_data-\u003elen, GFP_KERNEL_ACCOUNT);\n\nUse the validated value for the allocation as intended. Without this\nfix userspace can trigger \u003e4GB allocations which will fail and result\nin a WARN due to MAX_PAGE_ORDER.","modified":"2026-09-17T03:47:26.066604462Z","published":"2026-09-16T10:32:18.785Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89926.json","cna_assigner":"Linux"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3fe801db90bdeefb0bbdda42d832846b53f64f8a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4c07680a467e2f7697245bcd11691bffb2a6f0ed"},{"type":"WEB","url":"https://git.kernel.org/stable/c/71153d3262517e1c02c3a66aa5094f279b2d1454"},{"type":"WEB","url":"https://git.kernel.org/stable/c/aef540194effd768bed0bd2e6a74fe135a3d7c3a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b94ab9caa5d72c78226121cccff5e33f946da900"},{"type":"WEB","url":"https://git.kernel.org/stable/c/beb9c55af609c4c7308259d7191688c75a4e3d4a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fec89d327d9b2b669b5bbdac209386c6317c3722"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89926.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89926"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"27291e2165b6de70c476b7b675308113edd69a60"},{"fixed":"aef540194effd768bed0bd2e6a74fe135a3d7c3a"},{"fixed":"71153d3262517e1c02c3a66aa5094f279b2d1454"},{"fixed":"fec89d327d9b2b669b5bbdac209386c6317c3722"},{"fixed":"b94ab9caa5d72c78226121cccff5e33f946da900"},{"fixed":"beb9c55af609c4c7308259d7191688c75a4e3d4a"},{"fixed":"3fe801db90bdeefb0bbdda42d832846b53f64f8a"},{"fixed":"4c07680a467e2f7697245bcd11691bffb2a6f0ed"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89926.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0"},{"fixed":"5.15.221"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.51"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89926.json"}}],"schema_version":"1.9.0"}