CVE-2026-89923 Overview
CVE-2026-89923 is a memory leak vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the s390 architecture. The flaw exists in the guest debug data handling path, where kvm_s390_clear_bp_data() is only invoked from kvm_arch_vcpu_ioctl_set_guest_debug(). When a virtual CPU is destroyed with hardware breakpoints still armed, which is the normal path when a Virtual Machine Monitor (VMM) exits or crashes, the kernel leaks hw_bp_info, hw_wp_info, and all old_data buffers. The leak is bounded by MAX_BP_COUNT entries per vCPU but grows unbounded across VM lifetimes, pinning dying memory control groups (memcgs).
Critical Impact
Repeated VM lifecycles on s390 hosts progressively exhaust kernel memory accounted to terminated cgroups, degrading host stability over time.
Affected Products
- Linux kernel KVM subsystem on IBM s390 (mainframe) architecture
- Host systems running virtual machines via kvm-s390 with guest debug features
- Distributions shipping affected kernel versions until stable patches are backported
Discovery Timeline
- 2026-09-16 - CVE-2026-89923 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89923
Vulnerability Analysis
The vulnerability is a kernel memory leak ([CWE-401]) in the s390 KVM guest debug facility. Guest debugging on s390 allocates per-vCPU structures to track hardware breakpoints and watchpoints, including hw_bp_info, hw_wp_info, and old_data buffers used to save memory contents at breakpoint locations. These allocations use GFP_KERNEL_ACCOUNT, meaning they are charged to the memory cgroup of the VMM process.
The cleanup routine kvm_s390_clear_bp_data() is only reachable through the KVM_SET_GUEST_DEBUG ioctl path, which user space calls when reconfiguring or disabling debugging. When a VMM exits normally, crashes, or is killed while breakpoints are armed, generic KVM code invokes kvm_arch_vcpu_destroy() and then frees the struct kvm_vcpu. The debug allocations are never released, and their memcg charges outlive the process, keeping the dying cgroup pinned in the kernel.
Root Cause
The root cause is missing cleanup coverage on the vCPU destruction path. The s390 KVM implementation ties breakpoint teardown to an explicit user space ioctl rather than to the vCPU lifecycle. This assumption breaks whenever the VMM terminates without first calling KVM_SET_GUEST_DEBUG to disable debugging.
Attack Vector
The issue is not a remotely exploitable flaw. Local users or workloads capable of repeatedly creating and destroying KVM guests with hardware debug enabled can drive continuous kernel memory consumption, contributing to resource exhaustion and cgroup pinning. Exploitation requires the ability to invoke KVM ioctls on an s390 host.
The vulnerability manifests in the s390 KVM guest debug cleanup path. See the upstream commits linked in the references for the code-level fix: Kernel Commit 053f2068 and Kernel Commit e7f698b0.
Detection Methods for CVE-2026-89923
Indicators of Compromise
- Growing kmalloc slab consumption on s390 KVM hosts that does not shrink after VMs terminate
- Persistent memory cgroups visible under /sys/fs/cgroup/memory/ for processes that have already exited
- Steady increase in MemAvailable decline correlated with VM churn on affected kernels
Detection Strategies
- Audit hosts for kernel versions that have not received the fix commits (053f2068, 544a5a66, 6c996b12, 9a32c4c6, b5acacfdb, d6280fc5, e4d8b7f1, e7f698b0)
- Correlate VM lifecycle events with slab allocator statistics from /proc/slabinfo to identify unbounded growth after guest termination
- Track memory.stat counters in cgroups v2 to spot orphaned charges tied to destroyed VMMs
Monitoring Recommendations
- Instrument s390 hosts to alert on rising counts of zombie memcgs using tools such as bpftrace or perf
- Monitor kernel logs for pressure stall information (PSI) increases on hosts running frequent guest debug sessions
- Ingest host telemetry into a centralized analytics platform to baseline slab and cgroup memory trends across the fleet
How to Mitigate CVE-2026-89923
Immediate Actions Required
- Apply the upstream stable kernel updates referenced by the fix commits as soon as vendor backports are available
- Restrict use of KVM_SET_GUEST_DEBUG and hardware breakpoint features to trusted VMMs on s390 hosts
- Schedule periodic host reboots on impacted systems until patches are deployed to reclaim leaked memory
Patch Information
The fix clears debug data unconditionally on vCPU destruction. Because struct kvm_vcpu is zero-allocated, calling the cleanup routine on a vCPU that never enabled debugging is safe (counters are zero and pointers are NULL). Backports are tracked across multiple stable branches through the commits listed in the Linux kernel stable tree references.
Workarounds
- Avoid enabling guest hardware debugging on production s390 VMs when possible
- Ensure VMMs explicitly issue KVM_SET_GUEST_DEBUG with debugging disabled before termination to trigger cleanup
- Cap VM churn on affected hosts and monitor cgroup memory pressure to preempt exhaustion conditions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.