CVE-2026-64369

Source
https://cve.org/CVERecord?id=CVE-2026-64369
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64369.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-64369
Downstream
Published
2026-07-25T08:50:22.543Z
Modified
2026-07-27T04:03:21.550229107Z
Summary
s390: Revert support for DCACHE_WORD_ACCESS
Details

In the Linux kernel, the following vulnerability has been resolved:

s390: Revert support for DCACHEWORDACCESS

loadunalignedzeropad() reads eight bytes from unaligned addresses and may cross page boundaries. It handles exceptions which may happen if reading from the second page results in an exception.

For pages which are donated to the Ultravisor for secure execution purposes the dosecurestorage_access() exception handler however does not handle such exceptions correctly. Such an exception may result in an endless exception loop which will never be resolved.

An attempt to fix this [1] turned out to be not sufficient. For now revert loadunalignedzeropad() until this problem has been resolved in a proper way.

Note that the implementation of loadunalignedzeropad() itself is correct. The revert is just a temporary workaround until there is complete fix for secure storage access exceptions.

[1] commit b00be77302d7 ("s390/mm: Add missing secure storage access fixups for donated memory")

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64369.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
802ba53eefc592a6a82231f74e19bafe3256f172
Fixed
c9e0f1517631ac08987f8385817119bccf2f1f12
Fixed
be79d285bea70d0edd5015bd487311bfa8cbebc9
Fixed
c94806905e02cc8e17a69c822d93c41743b7ffc5
Fixed
37540b8c287fc817bdbd0c62bb75ad6eab0e5d03

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64369.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.97
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.39
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.4

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64369.json"