CVE-2026-72290 KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
A refcount leak in KVM s390 PCI handling allows local attackers to cause resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72290?
CVE-2026-72290 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
kvm_s390_gisc_register() registers the guest ISC before pinning the guest interrupt forwarding pages and allocating the AISB bit. If any of the later setup steps fails, the function unwinds the pinned pages and other local state, but does not unregister the GISC reference. Add the missing kvm_s390_gisc_unregister() to the error unwind path.
Which versions are affected by CVE-2026-72290?
How do I fix CVE-2026-72290?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-72290 being exploited?
There is no known exploitation of CVE-2026-72290 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72290, DEBIAN-CVE-2026-72290, GHSA-w6f2-9h8p-7g45, UBUNTU-CVE-2026-72290.