Executive brief
The Linux kernel's KVM hypervisor module for IBM s390 systems contains a memory leak in its guest debugging functionality. When a guest debug request fails partway through processing multiple watchpoints, allocated memory buffers are not properly freed, allowing an attacker to repeatedly trigger failed requests and exhaust available system memory, potentially causing denial of service.
Technical details
The vulnerability is a memory leak (CWE-401) in the KVM s390 guest debugging code (arch/s390/kvm/guestdbg.c). The function __import_wp_info() allocates per-watchpoint old_data buffers (up to MAX_WP_SIZE bytes each) to preserve original guest memory contents. When kvm_s390_import_bp_data() processes multiple watchpoints via a KVM_SET_GUEST_DEBUG request and a later watchpoint fails to import, the error path frees the wp_info array but not the successfully-allocated old_data buffers, leaking up to (MAX_BP_COUNT - 1) × MAX_WP_SIZE bytes. A local privileged user with access to KVM guest debugging can repeat failed requests to accumulate memory leaks. The fix adds proper cleanup of all allocated old_data buffers in a dedicated error handler before freeing the main structures.
Affected products
- Linux Linux kernel multiple versions (patch applied to stable branches 4.4 onwards)
Timeline
- 2026-09-16: disclosed
- 2026-08-05: patched: Upstream commit aa9c8e8baf1e765fa65b93212522c636f25d846f