CVE-2026-89925 - Vulnerability Details

- KVM: s390: Fix memory leak in guest debug handling

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Fix memory leak in guest debug handling

bp_data is freed only for the error case by kfree(bp_data).
Every successful KVM_SET_GUEST_DEBUG will leak bp_data.

Published: 2026-09-16

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability involves a memory leak in the KVM s390 guest debug handling. When a guest performs a KVM_SET_GUEST_DEBUG call, the kernel allocates bp_data but frees it only on error. Successful calls therefore leave a dangling allocation, leading to a memory leak that can grow unbounded if repeatedly invoked. This flaw is a classic memory management issue and matches CWE-401: Memory Leak.

Affected Systems

All Linux kernel releases that support the s390 KVM guest debug interface are affected; no specific version range is listed, so any kernel prior to the patch commits referenced in the advisory is vulnerable.

Risk and Exploitability

The EPSS score is below 1% and the CVE is not listed in CISA KEV, indicating a low probability of exploitation in the wild. The CVSS score of 5.5 points to moderate severity. The flaw requires privileged access to the guest debug API, meaning an attacker must have control of a guest that can issue KVM_SET_GUEST_DEBUG. No public exploit exists, so the primary risk is denial of service through resource exhaustion if the vulnerable calls are executed repeatedly.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`27291e2165b6de70c476b7b675308113edd69a60`	affected	< 39e7cebb889839b5762c9ad22e2d715b5883b288
`27291e2165b6de70c476b7b675308113edd69a60`	affected	< 58b1b729a9f90c80b508fc3e2174cbc0ee50859e
`27291e2165b6de70c476b7b675308113edd69a60`	affected	< 9071f75cbde3bf46119cb28e92cfbef830c4bf97
`27291e2165b6de70c476b7b675308113edd69a60`	affected	< 5940418e4232a2ff1d30ba12e0d213dbf48f0a83
`27291e2165b6de70c476b7b675308113edd69a60`	affected	< fc2034c431adcbaabf5f8a01912358f07355349e
`27291e2165b6de70c476b7b675308113edd69a60`	affected	< 44bf3792c10f4bb3de507391f1837e020d92eaa2
`27291e2165b6de70c476b7b675308113edd69a60`	affected	< 581be9f6085834188cef1ad2f07babf3b421e409
`27291e2165b6de70c476b7b675308113edd69a60`	affected	< 121ea1de927c8b9bfdf53c31cad27b86d5de0293

Linux

affected

Version	Status	Constraints
`3.16`	affected	—
`0`	unaffected	< 3.16
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[27291e2165b6de70c476b7b675308113edd69a60,39e7cebb889839b5762c9ad22e2d715b5883b288)`	affected	code_commit	—
`[27291e2165b6de70c476b7b675308113edd69a60,58b1b729a9f90c80b508fc3e2174cbc0ee50859e)`	affected	code_commit	—
`[27291e2165b6de70c476b7b675308113edd69a60,9071f75cbde3bf46119cb28e92cfbef830c4bf97)`	affected	code_commit	—
`[27291e2165b6de70c476b7b675308113edd69a60,5940418e4232a2ff1d30ba12e0d213dbf48f0a83)`	affected	code_commit	—
`[27291e2165b6de70c476b7b675308113edd69a60,fc2034c431adcbaabf5f8a01912358f07355349e)`	affected	code_commit	—
`[27291e2165b6de70c476b7b675308113edd69a60,44bf3792c10f4bb3de507391f1837e020d92eaa2)`	affected	code_commit	—
`[27291e2165b6de70c476b7b675308113edd69a60,581be9f6085834188cef1ad2f07babf3b421e409)`	affected	code_commit	—
`[27291e2165b6de70c476b7b675308113edd69a60,121ea1de927c8b9bfdf53c31cad27b86d5de0293)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.16`	affected	generic	—
`[0,3.16)`	unaffected	generic	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel release that incorporates the fixes from the commit chain linked above.
If an immediate upgrade is not possible, disable or restrict the KVM guest debug feature in the host configuration to prevent guests from making KVM_SET_GUEST_DEBUG calls.
Continuously monitor host memory consumption and alert on sudden increases that may indicate repeated allocation of bp_data, allowing preemptive intervention before exhaustion occurs.

Generated by OpenCVE AI on September 24, 2026 at 02:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89925.mbox
https://git.kernel.org/stable/c/121ea1de927c8b9bfdf53c31cad27b86d5de0293
https://git.kernel.org/stable/c/39e7cebb889839b5762c9ad22e2d715b5883b288
https://git.kernel.org/stable/c/44bf3792c10f4bb3de507391f1837e020d92eaa2
https://git.kernel.org/stable/c/581be9f6085834188cef1ad2f07babf3b421e409
https://git.kernel.org/stable/c/58b1b729a9f90c80b508fc3e2174cbc0ee50859e
https://git.kernel.org/stable/c/5940418e4232a2ff1d30ba12e0d213dbf48f0a83
https://git.kernel.org/stable/c/9071f75cbde3bf46119cb28e92cfbef830c4bf97
https://git.kernel.org/stable/c/fc2034c431adcbaabf5f8a01912358f07355349e
https://nvd.nist.gov/vuln/detail/CVE-2026-89925
https://www.cve.org/CVERecord?id=CVE-2026-89925

History

Thu, 24 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89925.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-89925 https://www.cve.org/CVERecord?id=CVE-2026-89925
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Fri, 18 Sep 2026 03:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Wed, 16 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory leak in guest debug handling bp_data is freed only for the error case by kfree(bp_data). Every successful KVM_SET_GUEST_DEBUG will leak bp_data.
Title		KVM: s390: Fix memory leak in guest debug handling
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/121ea1de927c8b9bfdf53c31cad27b86d5de0293 https://git.kernel.org/stable/c/39e7cebb889839b5762c9ad22e2d715b5883b288 https://git.kernel.org/stable/c/44bf3792c10f4bb3de507391f1837e020d92eaa2 https://git.kernel.org/stable/c/581be9f6085834188cef1ad2f07babf3b421e409 https://git.kernel.org/stable/c/58b1b729a9f90c80b508fc3e2174cbc0ee50859e https://git.kernel.org/stable/c/5940418e4232a2ff1d30ba12e0d213dbf48f0a83 https://git.kernel.org/stable/c/9071f75cbde3bf46119cb28e92cfbef830c4bf97 https://git.kernel.org/stable/c/fc2034c431adcbaabf5f8a01912358f07355349e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T10:32:18.111Z

Updated: 2026-09-16T10:32:18.111Z

Reserved: 2026-09-11T19:38:34.775Z

Link: CVE-2026-89925

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T11:17:01.653

Modified: 2026-09-16T11:17:01.653

Link: CVE-2026-89925

Redhat

Severity : Low

Publid Date: 2026-09-16T00:00:00Z

Links: CVE-2026-89925 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-24T02:15:14Z

Weaknesses

CWE-401
Missing Release of Memory after Effective Lifetime
CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object