Executive brief
The Linux kernel's KVM (Kernel Virtual Machine) module on s390 architecture contains a memory leak in the guest debug handling code. When a virtual machine debug session is configured using the KVM_SET_GUEST_DEBUG operation, allocated memory is not properly freed on success, only on error paths. Over time, repeated debug operations can exhaust system memory and degrade or crash the host.
Technical details
A memory leak exists in the kvm_s390_import_bp_data() function in arch/s390/kvm/guestdbg.c. The bp_data buffer is only freed in the error path via kfree(bp_data), but when the function returns successfully (return 0), bp_data is never deallocated. This occurs every time KVM_SET_GUEST_DEBUG is called successfully. The vulnerability is local to the hypervisor and requires privileged access to trigger (ability to set guest debug configuration), but repeated invocation can lead to kernel memory exhaustion. A patch adds kfree(bp_data) before the successful return statement.
Affected products
- Linux Linux kernel Affected versions include kernel series 2.6.11 through 7.2 as indicated by stable tree branches; original issue introduced in commit 27291e2165b6
Timeline
- 2026-08-05: other: Fix committed upstream by Christian Borntraeger
- 2026-09-16: disclosed: CVE-2026-89925 published on NVD