CVE-2026-89923 KVM: s390: Free guest debug data on vcpu destroy
A memory leak in the Linux kernel's KVM s390 implementation allows local attackers to exhaust system memory by repeatedly creating and destroying virtual CPUs with active hardware breakpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89923?
CVE-2026-89923 is a memory corruption vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Free guest debug data on vcpu destroy
kvm_s390_clear_bp_data() is only called from kvm_arch_vcpu_ioctl_set_guest_debug(), i.e. when user space changes or disables debugging. A vCPU that is destroyed while hardware breakpoints are still armed - the normal case when the VMM just exits or crashes - leaks hw_bp_info, hw_wp_info and all old_data buffers, since generic KVM frees the vCPU right after kvm_arch_vcpu_destroy().
That is bounded by MAX_BP_COUNT entries, so roughly 8 KiB per vCPU, but it is unbounded over VM lifetimes. The allocations are GFP_KERNEL_ACCOUNT, so the charge also outlives the exiting process and pins dying memcgs.
Fix by clearing the debug data on vCPU destruction. Calling it unconditionally is fine: struct kvm_vcpu is zero allocated, so for a vCPU that never enabled debugging the counters are 0 and the pointers NULL.
Which versions are affected by CVE-2026-89923?
How do I fix CVE-2026-89923?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89923 being exploited?
There is no known exploitation of CVE-2026-89923 in the wild and no public exploit code.
Sources
Also known as AZL-101465, BELL-CVE-2026-89923, DEBIAN-CVE-2026-89923, GHSA-69xh-7r26-q3mw, UBUNTU-CVE-2026-89923.