CVE-2026-89459
nicheLinux kernel (s390): per-CPU repair code silently dropped when built with old binutils
A build-time flaw in the Linux kernel's s390 percpu code causes the MVIY_PERCPU() macro to emit a whitespace-separated, quoted assembler macro invocation that GNU as versions prior to binutils 2.39 silently collapse into a single argument during input scrubbing. The assembler then prints repeated 'missing closing quote' warnings yet exits successfully without emitting the mviy instruction, so an affected kernel build completes with the interrupted per-CPU sequence unmarked in lowcore. At runtime, the exception return path consequently cannot repair the per-CPU address register after a task migrates between CPUs, leaving stale per-CPU addressing that can read and write the wrong per-CPU memory and corrupt kernel state, rated high (CVSS 3.1: 7.0, local vector, high attack complexity) with high impact on confidentiality, integrity and availability. Only IBM Z / LinuxONE (s390) kernels containing commit a737737cdb9c and compiled with GNU binutils 2.30 through 2.38 are affected; builds using binutils 2.39 or newer, or LLVM's integrated assembler, assemble correctly. No public proof of concept exists, the issue is not in the CISA KEV catalog, and no exploitation is known.
What to do: Update to a kernel containing the fix, which passes the C string literals directly and separates assembler macro arguments with an explicit comma (GEN_MVIY 459712, %r3), or rebuild s390 kernels with binutils 2.39 or newer or LLVM's integrated assembler. Because GNU as exits successfully despite omitting the instruction, audit build logs of any s390 kernel compiled with binutils 2.30-2.38 for 'missing closing' warnings from GEN_MVIY as evidence of a silently broken build. There is no runtime mitigation; affected kernel binaries must be rebuilt.
| Linux kernel (kernel.org) Linux kernel, s390 (IBM Z / LinuxONE) architecture | Kernels containing commit a737737cdb9c ('s390/percpu: Infrastructure for more efficient this_cpu operations') up to the fixing commit; vulnerable only when comp |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: s390/percpu: Fix MVIY_PERCPU() with older binutils Commit a737737cdb9c ("s390/percpu: Infrastructure for more efficient this_cpu operations") introduced MVIY_PERCPU(), which stringifies arguments that are already C string literals. This generates an assembler macro invocation with whitespace-separated quoted arguments: GEN_MVIY "459712" "%r3" GNU as versions prior to binutils 2.39 drop the separating whitespace between quoted macro arguments during input scrubbing. They consequently parse the invocation as a single argument and emit repeated warnings: Warning: missing closing `"' The .ifc in GEN_MVIY never matches and GNU as exits successfully without emitting the mviy instruction. As a result, the interrupted per-CPU sequence is not marked in lowcore and the exception return path cannot repair the per-CPU address register after migration. All MVIY_PERCPU() callers pass C string literals. Use them directly and separate the assembler macro arguments with an explicit comma. The resulting invocation is: GEN_MVIY 459712, %r3 This form is unambiguous for GNU as and LLVM's integrated assembler. This behavior was fixed in GNU as from binutils 2.39, but Linux supports binutils 2.30.
- Vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.