CVE-2026-72292 KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory
A local attacker with KVM access can read uninitialized kernel memory via the KVM_S390_GET_CMMA_BITS ioctl due to missing buffer initialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72292?
CVE-2026-72292 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory
kvm_s390_get_cmma_bits() allocates its output buffer with vmalloc(), which does not zero the returned pages:
values = vmalloc(args->count);
In the non-peek (migration) path, dat_get_cmma() reports a byte count spanning from the first to the last dirty page, but __dat_get_cmma_pte() writes values[gfn - start] only for pages whose CMMA dirty bit is set. The walk uses DAT_WALK_IGN_HOLES, so clean and unmapped pages that lie between two dirty pages within the reported span are visited but never store their byte. Those gaps (up to KVM_S390_MAX_BIT_DISTANCE pages each) stay uninitialized yet fall inside [0, count) and are copied out by copy_to_user(), disclosing stale kernel memory to user space.
Before the switch to the new gmap implementation the buffer was fully populated for every gfn in the span, so no uninitialized bytes were exposed; the dirty-only walk introduced the leak.
Use vzalloc() so the gaps read back as zero.
Which versions are affected by CVE-2026-72292?
How do I fix CVE-2026-72292?
Apply the vendor's patch.
Is CVE-2026-72292 being exploited?
There is no known exploitation of CVE-2026-72292 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-72292, GHSA-g39r-65h4-wx32, UBUNTU-CVE-2026-72292.