CVE-2026-89924

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix old_data leak in guest debug error path __import_wp_info() allocates a per-watchpoint old_data buffer to back up the original guest memory contents. If a later watchpoint of the same KVM_SET_GUEST_DEBUG request fails to import, kvm_s390_import_bp_data() jumps to the error label, which frees the wp_info array but not the old_data buffers of the entries that were imported successfully. Up to MAX_BP_COUNT - 1 buffers of up to MAX_WP_SIZE bytes are leaked per failed request, and the request can be repeated. Create error handling for cleaning up all created old_data memory areas.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/124c81ee610e1fbdd93d4399f88d9e28ba97a941
https://git.kernel.org/stable/c/4048d0a252163084794be3e37995b872c5178913
https://git.kernel.org/stable/c/46cb8a273e2f853f89a78b59dbdff8787b6e1c86
https://git.kernel.org/stable/c/5fbf319137735252eefa507193c9a619af5b7457
https://git.kernel.org/stable/c/aa9c8e8baf1e765fa65b93212522c636f25d846f
https://git.kernel.org/stable/c/c85d402553987777cc4742751437ea5dcbf98a7b
https://git.kernel.org/stable/c/e5ae7816e5ad145618f7fd568a0e8a94dd9f81f4
https://git.kernel.org/stable/c/f55e4d415d95342d5753e528e05a1e8623992c3f

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-16 11:17

Updated : 2026-09-16 11:17

NVD link : CVE-2026-89924

Mitre link : CVE-2026-89924

CVE.ORG link : CVE-2026-89924

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-89924", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "27291e2165b6de70c476b7b675308113edd69a60", "lessThan": "124c81ee610e1fbdd93d4399f88d9e28ba97a941", "versionType": "git"}, {"status": "affected", "version": "27291e2165b6de70c476b7b675308113edd69a60", "lessThan": "e5ae7816e5ad145618f7fd568a0e8a94dd9f81f4", "versionType": "git"}, {"status": "affected", "version": "27291e2165b6de70c476b7b675308113edd69a60", "lessThan": "c85d402553987777cc4742751437ea5dcbf98a7b", "versionType": "git"}, {"status": "affected", "version": "27291e2165b6de70c476b7b675308113edd69a60", "lessThan": "5fbf319137735252eefa507193c9a619af5b7457", "versionType": "git"}, {"status": "affected", "version": "27291e2165b6de70c476b7b675308113edd69a60", "lessThan": "4048d0a252163084794be3e37995b872c5178913", "versionType": "git"}, {"status": "affected", "version": "27291e2165b6de70c476b7b675308113edd69a60", "lessThan": "f55e4d415d95342d5753e528e05a1e8623992c3f", "versionType": "git"}, {"status": "affected", "version": "27291e2165b6de70c476b7b675308113edd69a60", "lessThan": "46cb8a273e2f853f89a78b59dbdff8787b6e1c86", "versionType": "git"}, {"status": "affected", "version": "27291e2165b6de70c476b7b675308113edd69a60", "lessThan": "aa9c8e8baf1e765fa65b93212522c636f25d846f", "versionType": "git"}], "programFiles": ["arch/s390/kvm/guestdbg.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.16"}, {"status": "unaffected", "version": "0", "lessThan": "3.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.270", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.221", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.188", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.157", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.110", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.51", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.5", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/s390/kvm/guestdbg.c"], "defaultStatus": "affected"}]}], "published": "2026-09-16T11:17:01.527", "references": [{"url": "https://git.kernel.org/stable/c/124c81ee610e1fbdd93d4399f88d9e28ba97a941", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4048d0a252163084794be3e37995b872c5178913", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/46cb8a273e2f853f89a78b59dbdff8787b6e1c86", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5fbf319137735252eefa507193c9a619af5b7457", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/aa9c8e8baf1e765fa65b93212522c636f25d846f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c85d402553987777cc4742751437ea5dcbf98a7b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e5ae7816e5ad145618f7fd568a0e8a94dd9f81f4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f55e4d415d95342d5753e528e05a1e8623992c3f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix old_data leak in guest debug error path\n\n__import_wp_info() allocates a per-watchpoint old_data buffer to back up\nthe original guest memory contents. If a later watchpoint of the same\nKVM_SET_GUEST_DEBUG request fails to import, kvm_s390_import_bp_data()\njumps to the error label, which frees the wp_info array but not the\nold_data buffers of the entries that were imported successfully. Up to\nMAX_BP_COUNT - 1 buffers of up to MAX_WP_SIZE bytes are leaked per failed\nrequest, and the request can be repeated.\n\nCreate error handling for cleaning up all created old_data memory\nareas."}], "lastModified": "2026-09-16T11:17:01.527", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}