SB2026091742 - Memory leak in Linux kernel s390 kvm
Published: September 17, 2026
Security Bulletin ID
SB2026091742
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Partial DoS
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Memory leak (CVE-ID: CVE-2026-89925)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to missing release of memory in KVM s390 guest debug handling when successfully processing KVM_SET_GUEST_DEBUG requests. A local user can repeatedly issue successful KVM_SET_GUEST_DEBUG requests to cause a denial of service.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/121ea1de927c8b9bfdf53c31cad27b86d5de0293
- https://git.kernel.org/stable/c/39e7cebb889839b5762c9ad22e2d715b5883b288
- https://git.kernel.org/stable/c/44bf3792c10f4bb3de507391f1837e020d92eaa2
- https://git.kernel.org/stable/c/581be9f6085834188cef1ad2f07babf3b421e409
- https://git.kernel.org/stable/c/58b1b729a9f90c80b508fc3e2174cbc0ee50859e
- https://git.kernel.org/stable/c/5940418e4232a2ff1d30ba12e0d213dbf48f0a83
- https://git.kernel.org/stable/c/9071f75cbde3bf46119cb28e92cfbef830c4bf97
- https://git.kernel.org/stable/c/fc2034c431adcbaabf5f8a01912358f07355349e