Memory leak in Linux kernel - CVE-2026-89924
Published: September 17, 2026
Vulnerability identifier: #VU150363
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89924
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource cleanup in the s390 KVM guest debug watchpoint import error path when importing watchpoint data from a KVM_SET_GUEST_DEBUG request. A local user can submit a KVM_SET_GUEST_DEBUG request in which a later watchpoint fails to import to cause a denial of service.
The request can be repeated, leaking up to MAX_BP_COUNT - 1 buffers of up to MAX_WP_SIZE bytes per failed request.
Affected software
Linux kernel
How to mitigate CVE-2026-89924
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/124c81ee610e1fbdd93d4399f88d9e28ba97a941
- https://git.kernel.org/stable/c/4048d0a252163084794be3e37995b872c5178913
- https://git.kernel.org/stable/c/46cb8a273e2f853f89a78b59dbdff8787b6e1c86
- https://git.kernel.org/stable/c/5fbf319137735252eefa507193c9a619af5b7457
- https://git.kernel.org/stable/c/aa9c8e8baf1e765fa65b93212522c636f25d846f
- https://git.kernel.org/stable/c/c85d402553987777cc4742751437ea5dcbf98a7b
- https://git.kernel.org/stable/c/e5ae7816e5ad145618f7fd568a0e8a94dd9f81f4
- https://git.kernel.org/stable/c/f55e4d415d95342d5753e528e05a1e8623992c3f