In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix unlikely race in try_get_locked_pte()
Fix an unlikely race in try_get_locked_pte(), which could have happened
if puds or pmds get unmapped between the p?dp_get() and p?d_offset()
functions.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.3
AV:L - The flaw is in KVM s390 host page-table walking triggered by local guest hypervisor intercepts (UVC, ESSA) and /dev/kvm ioctls, not by remote network packet handling.
AC:L - An attacker can control both sides of the race using multiple vCPUs or threads to concurrently trigger KVM gmap unmap/PV operations while host backing mappings are torn down via slot changes or ballooning.
PR:N - A malicious s390 KVM guest can reach the vulnerable paths through hypervisor instruction intercepts without requiring host administrator privileges or CAP_SYS_ADMIN on the hypervisor.
UI:N - Exploitation requires only attacker-controlled guest execution and concurrent memory management activity, with no additional victim actions such as opening files or mounting filesystems.
S:C - Corrupting host kernel page tables while servicing guest memory operations crosses the guest-host virtualization security boundary and enables VM escape-class impact on shared IBM Z KVM hosts.
C:H - The race dereferences freed intermediate page-table pages and can yield attacker-influenced PTE pointers, enabling arbitrary kernel memory disclosure through subsequent PTE reads.
I:H - Corrupted PTE pointers lead to atomic PTE bit updates and secure-page folio operations on attacker-chosen kernel memory, providing a plausible path to arbitrary write or code execution.
A:H - Dereferencing freed or collapsed page-table structures or corrupting PTEs can cause kernel oops, panic, or repeated guest-triggered crashes denying host availability.
| Attack Vector |
Local |
Scope |
Changed |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The flaw is in KVM s390 host page-table walking triggered by local guest hypervisor intercepts (UVC, ESSA) and /dev/kvm ioctls, not by remote network packet handling.
AC:L - An attacker can control both sides of the race using multiple vCPUs or threads to concurrently trigger KVM gmap unmap/PV operations while host backing mappings are torn down via slot changes or ballooning.
PR:N - A malicious s390 KVM guest can reach the vulnerable paths through hypervisor instruction intercepts without requiring host administrator privileges or CAP_SYS_ADMIN on the hypervisor.
UI:N - Exploitation requires only attacker-controlled guest execution and concurrent memory management activity, with no additional victim actions such as opening files or mounting filesystems.
S:C - Corrupting host kernel page tables while servicing guest memory operations crosses the guest-host virtualization security boundary and enables VM escape-class impact on shared IBM Z KVM hosts.
C:H - The race dereferences freed intermediate page-table pages and can yield attacker-influenced PTE pointers, enabling arbitrary kernel memory disclosure through subsequent PTE reads.
I:H - Corrupted PTE pointers lead to atomic PTE bit updates and secure-page folio operations on attacker-chosen kernel memory, providing a plausible path to arbitrary write or code execution.
A:H - Dereferencing freed or collapsed page-table structures or corrupting PTEs can cause kernel oops, panic, or repeated guest-triggered crashes denying host availability.
CVSS 3.1