FKIE_CVE-2026-89923

Vulnerability from fkie_nvd - Published: 2026-09-16 11:17 - Updated: 2026-09-16 11:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Free guest debug data on vcpu destroy kvm_s390_clear_bp_data() is only called from kvm_arch_vcpu_ioctl_set_guest_debug(), i.e. when user space changes or disables debugging. A vCPU that is destroyed while hardware breakpoints are still armed - the normal case when the VMM just exits or crashes - leaks hw_bp_info, hw_wp_info and all old_data buffers, since generic KVM frees the vCPU right after kvm_arch_vcpu_destroy(). That is bounded by MAX_BP_COUNT entries, so roughly 8 KiB per vCPU, but it is unbounded over VM lifetimes. The allocations are GFP_KERNEL_ACCOUNT, so the charge also outlives the exiting process and pins dying memcgs. Fix by clearing the debug data on vCPU destruction. Calling it unconditionally is fine: struct kvm_vcpu is zero allocated, so for a vCPU that never enabled debugging the counters are 0 and the pointers NULL.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/053f2068cf9b0654b651fed5ad7649d3deb982bf
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/544a5a665019cef394ce8bda97fa7a2cab253781
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6c996b12bbe4a6023076e8eee3cfaf2cc99db76c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9a32c4c6a6c23b7f5bf765eb5b83ba7f64a8ec63
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b5acacfdb8966abff91836c1c5bd7da59d8a526e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d6280fc540d8f4653c9b54a78cb747e128070f5e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e4d8b7f176b976474e0800ba71ee2dfa3ce263c9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e7f698b09d4a7c36b299acf680fc50fe868e2bcd
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kvm/kvm-s390.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "053f2068cf9b0654b651fed5ad7649d3deb982bf",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            },
            {
              "lessThan": "6c996b12bbe4a6023076e8eee3cfaf2cc99db76c",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            },
            {
              "lessThan": "d6280fc540d8f4653c9b54a78cb747e128070f5e",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            },
            {
              "lessThan": "544a5a665019cef394ce8bda97fa7a2cab253781",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            },
            {
              "lessThan": "9a32c4c6a6c23b7f5bf765eb5b83ba7f64a8ec63",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            },
            {
              "lessThan": "b5acacfdb8966abff91836c1c5bd7da59d8a526e",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            },
            {
              "lessThan": "e4d8b7f176b976474e0800ba71ee2dfa3ce263c9",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            },
            {
              "lessThan": "e7f698b09d4a7c36b299acf680fc50fe868e2bcd",
              "status": "affected",
              "version": "27291e2165b6de70c476b7b675308113edd69a60",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kvm/kvm-s390.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Free guest debug data on vcpu destroy\n\nkvm_s390_clear_bp_data() is only called from\nkvm_arch_vcpu_ioctl_set_guest_debug(), i.e. when user space changes or\ndisables debugging. A vCPU that is destroyed while hardware breakpoints\nare still armed - the normal case when the VMM just exits or crashes -\nleaks hw_bp_info, hw_wp_info and all old_data buffers, since generic KVM\nfrees the vCPU right after kvm_arch_vcpu_destroy().\n\nThat is bounded by MAX_BP_COUNT entries, so roughly 8 KiB per vCPU, but\nit is unbounded over VM lifetimes. The allocations are\nGFP_KERNEL_ACCOUNT, so the charge also outlives the exiting process and\npins dying memcgs.\n\nFix by clearing the debug data on vCPU destruction. Calling it\nunconditionally is fine: struct kvm_vcpu is zero allocated, so for a vCPU\nthat never enabled debugging the counters are 0 and the pointers NULL."
    }
  ],
  "id": "CVE-2026-89923",
  "lastModified": "2026-09-16T11:17:01.397",
  "metrics": {},
  "published": "2026-09-16T11:17:01.397",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/053f2068cf9b0654b651fed5ad7649d3deb982bf"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/544a5a665019cef394ce8bda97fa7a2cab253781"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6c996b12bbe4a6023076e8eee3cfaf2cc99db76c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9a32c4c6a6c23b7f5bf765eb5b83ba7f64a8ec63"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b5acacfdb8966abff91836c1c5bd7da59d8a526e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d6280fc540d8f4653c9b54a78cb747e128070f5e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e4d8b7f176b976474e0800ba71ee2dfa3ce263c9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e7f698b09d4a7c36b299acf680fc50fe868e2bcd"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.