CVE-2026-72412
Linux · Kernel
A memory management flaw in the Linux kernel s390 architecture allows for potential guest memory corruption due to improper handling of the _PAGE_UNUSED bit in page table entries.
Executive summary
A critical vulnerability in the Linux kernel memory management subsystem on s390 systems could lead to guest memory corruption and potential system instability.
Vulnerability
The vulnerability involves improper clearing of the _PAGE_UNUSED bit within the s390 memory management code. This flaw allows the kernel to incorrectly identify used pages as unused, leading to premature discarding of data and subsequent memory corruption within guest environments.
Business impact
The exploitability of this flaw, combined with a CVSS score of 9.3, indicates a high risk to business operations relying on virtualization. Successful exploitation could result in significant data integrity loss, service outages for virtualized workloads, and potential compromise of guest-level security boundaries.
Remediation
Immediate Action: Update the Linux kernel to version 7.1.5 or later to incorporate the necessary fix for the _PAGE_UNUSED bit handling.
Proactive Monitoring: Monitor system logs for kernel-level memory faults or unexpected behavior in virtualized environments, particularly on s390 architecture hosts.
Compensating Controls: Ensure that host-level memory isolation and integrity checks are strictly enforced, although patching remains the only definitive remediation.
Exploitation status
Public Exploit Available: Unknown
Analyst recommendation
Given the critical severity and the potential for memory corruption in virtualized environments, organizations utilizing Linux on s390 architecture should prioritize patching to version 7.1.5 or newer. Testing of kernel updates in a staging environment is advised to ensure compatibility before deploying to production hosts.