CVE-2026-89909LoongArch: KVM: Free init resources if kvm_init() fails
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Free init resources if kvm_init() fails kvm_loongarch_init() calls kvm_loongarch_env_init() to allocate the per-CPU kvm_context (vmcs) and kvm_loongarch_ops and to register the perf callbacks, and then calls kvm_init(). If kvm_init() fails its result is returned directly, but since module_init() does not run the module_exit() stuff on failure, so kvm_loongarch_env_exit() is never called and those resources are leaked. So call kvm_loongarch_env_exit() when kvm_init() fails, matching the teardown-on-failure pattern used by riscv_kvm_init().
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2bd6ac68726131da32ace9717aa63ff68cf6605c before 6bbbd7b719233645a5c120557a9ca1422e6b7a48; from 2bd6ac68726131da32ace9717aa63ff68cf6605c before 6b78786ee7260d9818cf1d7a245b7a655ef83076; from 2bd6ac68726131da32ace9717aa63ff68cf6605c before 3bf6f5e2e1007d38a5f35bd37e94ab645a0c40bc; from 2bd6ac68726131da32ace9717aa63ff68cf6605c before f7a1064cce3b100b54780c68529176232d8eb01e | CNA record |
References
- https://git.kernel.org/stable/c/6bbbd7b719233645a5c120557a9ca1422e6b7a48
- https://git.kernel.org/stable/c/6b78786ee7260d9818cf1d7a245b7a655ef83076
- https://git.kernel.org/stable/c/3bf6f5e2e1007d38a5f35bd37e94ab645a0c40bc
- https://git.kernel.org/stable/c/f7a1064cce3b100b54780c68529176232d8eb01e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.