Executive brief
KVM is a virtualization system that runs virtual machines. When a virtual machine with active hardware breakpoints is shut down without explicitly disabling those breakpoints, the Linux kernel fails to free the associated debug data structures. This causes a memory leak of approximately 8 KB per virtual CPU, and the leaked memory remains charged to memory control groups even after the process exits.
Technical details
The vulnerability is a memory leak in KVM's s390 architecture implementation. The kvm_s390_clear_bp_data() function, which deallocates hardware breakpoint and watchpoint data structures (hw_bp_info, hw_wp_info, and old_data buffers), was only called during explicit guest debug configuration changes, not during vCPU destruction. When a vCPU is destroyed while debug features remain armed—the typical case when a hypervisor crashes or exits—these allocations are not freed. Although the leak is bounded by MAX_BP_COUNT (roughly 8 KiB per vCPU), it is unbounded over the VM's lifetime and pinned to memory control groups via GFP_KERNEL_ACCOUNT charges. The fix adds an unconditional call to kvm_s390_clear_bp_data() in kvm_arch_vcpu_destroy(), which is safe because zero-allocated vCPU structures will have null pointers and zero counters if debugging was never enabled.
Affected products
- Linux Linux kernel all s390 KVM deployments, patched in commit e7f698b09d4a7c36b299acf680fc50fe868e2bcd
Timeline
- 2026-09-16: disclosed
- 2026-09-14: patched: Commit e7f698b09d4a7c36b299acf680fc50fe868e2bcd integrated into stable branches