CVE-2026-89909 LoongArch: KVM: Free init resources if kvm_init() fails
A resource leak in the Linux kernel's LoongArch KVM initialization allows local attackers to cause memory exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89909?
CVE-2026-89909 is a vulnerability in Linux, published on 16 Sep 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: KVM: Free init resources if kvm_init() fails
kvm_loongarch_init() calls kvm_loongarch_env_init() to allocate the per-CPU kvm_context (vmcs) and kvm_loongarch_ops and to register the perf callbacks, and then calls kvm_init(). If kvm_init() fails its result is returned directly, but since module_init() does not run the module_exit() stuff on failure, so kvm_loongarch_env_exit() is never called and those resources are leaked.
So call kvm_loongarch_env_exit() when kvm_init() fails, matching the teardown-on-failure pattern used by riscv_kvm_init().
Which versions are affected by CVE-2026-89909?
How do I fix CVE-2026-89909?
Apply the vendor's patch.
Is CVE-2026-89909 being exploited?
There is no known exploitation of CVE-2026-89909 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89909, DEBIAN-CVE-2026-89909, GHSA-9g5j-xh66-prwm, UBUNTU-CVE-2026-89909.