CVE-2026-89923KVM: s390: Free guest debug data on vcpu destroy
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Free guest debug data on vcpu destroy kvm_s390_clear_bp_data() is only called from kvm_arch_vcpu_ioctl_set_guest_debug(), i.e. when user space changes or disables debugging. A vCPU that is destroyed while hardware breakpoints are still armed - the normal case when the VMM just exits or crashes - leaks hw_bp_info, hw_wp_info and all old_data buffers, since generic KVM frees the vCPU right after kvm_arch_vcpu_destroy(). That is bounded by MAX_BP_COUNT entries, so roughly 8 KiB per vCPU, but it is unbounded over VM lifetimes. The allocations are GFP_KERNEL_ACCOUNT, so the charge also outlives the exiting process and pins dying memcgs. Fix by clearing the debug data on vCPU destruction. Calling it unconditionally is fine: struct kvm_vcpu is zero allocated, so for a vCPU that never enabled debugging the counters are 0 and the pointers NULL.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 27291e2165b6de70c476b7b675308113edd69a60 builds before 053f2068cf9b0654b651fed5ad7649d3deb982bf; 27291e2165b6de70c476b7b675308113edd69a60 builds before 6c996b12bbe4a6023076e8eee3cfaf2cc99db76c; from 27291e2165b6de70c476b7b675308113edd69a60 before d6280fc540d8f4653c9b54a78cb747e128070f5e; 27291e2165b6de70c476b7b675308113edd69a60 builds before 544a5a665019cef394ce8bda97fa7a2cab253781; 27291e2165b6de70c476b7b675308113edd69a60 builds before 9a32c4c6a6c23b7f5bf765eb5b83ba7f64a8ec63; from 27291e2165b6de70c476b7b675308113edd69a60 before b5acacfdb8966abff91836c1c5bd7da59d8a526e; from 27291e2165b6de70c476b7b675308113edd69a60 before e4d8b7f176b976474e0800ba71ee2dfa3ce263c9; from 27291e2165b6de70c476b7b675308113edd69a60 before e7f698b09d4a7c36b299acf680fc50fe868e2bcd | CNA record |
References
- https://git.kernel.org/stable/c/053f2068cf9b0654b651fed5ad7649d3deb982bf
- https://git.kernel.org/stable/c/6c996b12bbe4a6023076e8eee3cfaf2cc99db76c
- https://git.kernel.org/stable/c/d6280fc540d8f4653c9b54a78cb747e128070f5e
- https://git.kernel.org/stable/c/544a5a665019cef394ce8bda97fa7a2cab253781
- https://git.kernel.org/stable/c/9a32c4c6a6c23b7f5bf765eb5b83ba7f64a8ec63
- https://git.kernel.org/stable/c/b5acacfdb8966abff91836c1c5bd7da59d8a526e
- https://git.kernel.org/stable/c/e4d8b7f176b976474e0800ba71ee2dfa3ce263c9
- https://git.kernel.org/stable/c/e7f698b09d4a7c36b299acf680fc50fe868e2bcd
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.