CVE-2026-98652

What it actually does

Missing SRCU read-side critical section in kvm_s390_set_irq_state() permits concurrent modification of IRQ state during Store status operations, creating a data race in the KVM s390 subsystem.

Why it matters to the business

Virtual machines running on s390-based hosts may experience unexpected crashes, corrupted IRQ state, or guest instability, reducing availability of workloads that rely on KVM virtualization.

How an attack unfolds

An attacker with the ability to invoke kvm_s390_set_irq_state concurrently with Store status operations can trigger the unprotected window; no public exploit code or named threat actors are known at this time.

How to fix it

Update the Linux kernel to a version containing the commit that adds kvm->srcu protection inside kvm_s390_set_irq_state().

How to confirm the fix worked

Inspect the kvm_s390_set_irq_state() function in the running kernel source or compiled binary to confirm the presence of srcu_read_lock/unlock around the Store status operation.

Typical attack path

1. Obtain local or guest access to an s390 KVM host
2. Trigger simultaneous calls to kvm_s390_set_irq_state and Store status paths
3. Exploit the missing SRCU protection to induce a race
4. Cause kernel panic, guest crash, or undefined IRQ behavior

How to detect it

Search kernel logs and dmesg for entries referencing kvm_s390_set_irq_state, Store status, or SRCU warnings; correlate with guest IRQ-related crashes on s390 hosts.

What your security team should do

• Prioritize kernel updates for all s390 KVM hosts within normal change windows
• Review virtualization platform release notes for backported fixes
• Increase monitoring of kernel oops and KVM-related panics on s390 systems