---
id: CVE-2026-98930
title: 'KVM: s390: Fix IRQ injection with SIGP Stop and Store Status'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: s390: Fix IRQ injection with SIGP Stop and Store Status

  When __inject_sigp_stop() is called for a Stop and Store Status
  operation, if the vCPU is running, the int…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6cddd432e3da5e25eccbc13844d03c871674a62e <
    3bd77c59576b1d447fd56cc689ae9523a334b924
  - >-
    Linux >= 6cddd432e3da5e25eccbc13844d03c871674a62e <
    a379ac504fcb8c6fc2aa36203f5489b9581eb2e0
  - >-
    Linux >= 6cddd432e3da5e25eccbc13844d03c871674a62e <
    d0e3bf633f0585a0c2c2105ea7723777d764fae5
  - >-
    Linux >= 6cddd432e3da5e25eccbc13844d03c871674a62e <
    d343407b728a80b74be3c24b59f15e60289ea527
  - Linux 4.0
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:08:17.513Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98930'
references:
  - url: 'https://git.kernel.org/stable/c/3bd77c59576b1d447fd56cc689ae9523a334b924'
  - url: 'https://git.kernel.org/stable/c/a379ac504fcb8c6fc2aa36203f5489b9581eb2e0'
  - url: 'https://git.kernel.org/stable/c/d0e3bf633f0585a0c2c2105ea7723777d764fae5'
  - url: 'https://git.kernel.org/stable/c/d343407b728a80b74be3c24b59f15e60289ea527'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.566Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Fix IRQ injection with SIGP Stop and Store Status

When __inject_sigp_stop() is called for a Stop and Store Status
operation, if the vCPU is running, the interrupt is marked as pending
and the status is stored by the thread performing the KVM_RUN IOCTL.

If the vCPU is already stopped, the status is stored immediately.

Storing the status means writing into userspace, which might fault, and
__inject_sigp_stop() is called from do_inject_vcpu() which in turn is
always called holding a spinlock, which is obviously an issue.

Fix this by returning -EWOULDBLOCK from __inject_sigp_stop(), and
adding a bool flag to indicate whether a store status is needed. The
callers of do_inject_vcpu() are modified to pass the pointer to the
bool flag; whenever a Store Status operation is needed, the callers can
now perform it outside the spinlock.

Opportunistically refactor kvm_s390_set_irq_state() to use
scoped_guard() and __free().

[ Added Fixes tag while picking -- Claudio ]

## Affected

- `Linux >= 6cddd432e3da5e25eccbc13844d03c871674a62e < 3bd77c59576b1d447fd56cc689ae9523a334b924`
- `Linux >= 6cddd432e3da5e25eccbc13844d03c871674a62e < a379ac504fcb8c6fc2aa36203f5489b9581eb2e0`
- `Linux >= 6cddd432e3da5e25eccbc13844d03c871674a62e < d0e3bf633f0585a0c2c2105ea7723777d764fae5`
- `Linux >= 6cddd432e3da5e25eccbc13844d03c871674a62e < d343407b728a80b74be3c24b59f15e60289ea527`
- `Linux 4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.