Threats tagged 'ghsa-fm87-69w9-6w3j'

A vulnerability in the Linux kernel's KVM s390 subsystem involves uninitialized data structures in the inject_pfault_token function. Specifically, only parts of the kvm_s390_irq struct are initialized, leaving other fields with stale stack data. While interrupt delivery uses only initialized fields, a host user can exploit migration ioctls to access this residual data. The issue is fixed by zero-initializing the affected data structures.