VDB

CVE-2026-89459

CVE-2026-89459 PUBLISHED CVSS 7 HIGH

Reported by Linux · Published September 11, 2026

In the Linux kernel, the following vulnerability has been resolved: s390/percpu: Fix MVIY_PERCPU() with older binutils Commit a737737cdb9c ("s390/percpu: Infrastructure for more efficient this_cpu operations") introduced MVIY_PERCPU(), which stringifies arguments that are already C string literals. This generates an assembler macro invocation with whitespace-separated quoted arguments: GEN_MVIY "459712" "%r3" GNU as versions prior to binutils 2.39 drop the separating whitespace between quoted macro arguments during input scrubbing. They consequently parse the invocation as a single argument and emit repeated warnings: Warning: missing closing `"' The .ifc in GEN_MVIY never matches and GNU as exits successfully without emitting the mviy instruction. As a result, the interrupted per-CPU sequence is not marked in lowcore and the exception return path cannot repair the per-CPU address register after migration. All MVIY_PERCPU() callers pass C string literals. Use them directly and separate the assembler macro arguments with an explicit comma. The resulting invocation is: GEN_MVIY 459712, %r3 This form is unambiguous for GNU as and LLVM's integrated assembler. This behavior was fixed in GNU as from binutils 2.39, but Linux supports binutils 2.30.

EPSS 0.11% · 1.3th percentile

Risk Scores

CVSS 3.1
7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.11%
1.3th percentile

Affected Products

VendorProductVersions
LinuxLinuxa737737cdb9c94e40a9926cdc2320f874c05d709, a737737cdb9c94e40a9926cdc2320f874c05d709
LinuxLinux7.2, 0, 7.2.4
linuxlinux_kernel7.2, 7.2, 7.2
LinuxLinuxa737737cdb9c94e40a9926cdc2320f874c05d709, a737737cdb9c94e40a9926cdc2320f874c05d709, 7.2

Timeline

  • Sep 11, 2026 CVE Published
  • Sep 12, 2026 EPSS Score
  • Sep 12, 2026 Coalition ESS Score
  • Sep 13, 2026 EPSS Score
  • Sep 13, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›