CVE-2026-89924 KVM: s390: Fix old_data leak in guest debug error path
A memory leak in the Linux kernel's KVM s390 subsystem allows local attackers to exhaust system memory via repeated failed guest debug requests, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89924?
CVE-2026-89924 is a memory corruption vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix old_data leak in guest debug error path
__import_wp_info() allocates a per-watchpoint old_data buffer to back up the original guest memory contents. If a later watchpoint of the same KVM_SET_GUEST_DEBUG request fails to import, kvm_s390_import_bp_data() jumps to the error label, which frees the wp_info array but not the old_data buffers of the entries that were imported successfully. Up to MAX_BP_COUNT - 1 buffers of up to MAX_WP_SIZE bytes are leaked per failed request, and the request can be repeated.
Create error handling for cleaning up all created old_data memory areas.
Which versions are affected by CVE-2026-89924?
How do I fix CVE-2026-89924?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89924 being exploited?
There is no known exploitation of CVE-2026-89924 in the wild and no public exploit code.
Sources
Also known as AZL-101538, BELL-CVE-2026-89924, DEBIAN-CVE-2026-89924, GHSA-xq38-q7w3-m3v4, UBUNTU-CVE-2026-89924.