CVE-2026-89924 Overview
CVE-2026-89924 is a memory leak vulnerability in the Linux kernel's KVM subsystem for the s390 (IBM Z) architecture. The flaw resides in the guest debug handling code path used when processing KVM_SET_GUEST_DEBUG ioctl requests. The function __import_wp_info() allocates a per-watchpoint old_data buffer to back up original guest memory contents. When a later watchpoint import fails, kvm_s390_import_bp_data() jumps to an error label that frees the wp_info array but leaves the previously allocated old_data buffers dangling in kernel memory.
Critical Impact
Up to MAX_BP_COUNT - 1 buffers of up to MAX_WP_SIZE bytes leak per failed request, and the request is repeatable by unprivileged callers with KVM access.
Affected Products
- Linux kernel (s390/IBM Z architecture) with KVM enabled
- Multiple stable kernel branches referenced in the upstream fix commits
- Distributions shipping vulnerable kernels for s390 hosts
Discovery Timeline
- 2026-09-16 - CVE-2026-89924 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89924
Vulnerability Analysis
The vulnerability is a kernel memory leak [CWE-401] in the s390 KVM guest debug handling logic. When user space issues a KVM_SET_GUEST_DEBUG ioctl to configure hardware watchpoints, the kernel iterates over the requested breakpoint array and calls __import_wp_info() for each entry. Each successful import allocates an old_data buffer containing the original guest memory bytes that the watchpoint will overwrite.
If a subsequent watchpoint import fails, control flow jumps to the shared error label in kvm_s390_import_bp_data(). That label frees only the top-level wp_info array. It does not iterate the previously initialized entries to release their old_data allocations. Each failed request can leak memory that is bounded per request but unbounded across repeated invocations.
Root Cause
The root cause is incomplete cleanup on the error path. The allocation logic tracks per-entry state, but the failure handler treats the array as a single object. The fix introduces error handling that walks all successfully imported entries and releases their associated old_data regions before returning the error to user space.
Attack Vector
A local user with access to /dev/kvm can trigger the leak by repeatedly issuing crafted KVM_SET_GUEST_DEBUG requests that succeed for one or more watchpoints and then fail on a later entry. Each iteration leaks kernel memory. Sustained exploitation results in kernel heap exhaustion and denial of service on the host. This attack requires local access to an s390 host with KVM in use and does not directly yield code execution or privilege escalation.
No verified public exploit code is available. Refer to the upstream commits linked in the references for the precise patch diff.
Detection Methods for CVE-2026-89924
Indicators of Compromise
- Growth in kernel kmalloc slab usage on s390 KVM hosts without a corresponding increase in running guests or workloads
- Repeated KVM_SET_GUEST_DEBUG ioctl calls from the same process returning error codes such as -EINVAL or -EFAULT
- Gradual reduction of MemAvailable in /proc/meminfo on hypervisor hosts running long-lived VMs
Detection Strategies
- Audit ioctl syscalls on /dev/kvm file descriptors and correlate failed KVM_SET_GUEST_DEBUG requests with the invoking PID and container context
- Track kernel slab statistics via /proc/slabinfo to identify anomalous, monotonically increasing allocations on s390 hypervisors
- Enable kmemleak on test kernels to confirm the leak signature originates from __import_wp_info()
Monitoring Recommendations
- Collect host telemetry on kernel memory usage and alert when MemAvailable trends downward outside baseline
- Log virtualization control plane activity, including VM debug and introspection API usage, into a centralized data lake for correlation
- Baseline expected KVM_SET_GUEST_DEBUG usage per tenant so unexpected callers or failure spikes generate alerts
How to Mitigate CVE-2026-89924
Immediate Actions Required
- Apply the upstream stable kernel updates that contain the fix commits referenced by the Linux kernel maintainers
- Restrict access to /dev/kvm on s390 hosts to trusted virtualization services and privileged operators only
- Reboot hypervisor hosts after patching to ensure the vulnerable code is fully replaced in the running kernel
Patch Information
The fix has been merged across multiple stable branches. Refer to the upstream commits: Kernel Patch 124c81e, Kernel Patch 4048d0a, Kernel Patch 46cb8a2, Kernel Patch 5fbf319, Kernel Patch aa9c8e8, Kernel Patch c85d402, Kernel Patch e5ae781, and Kernel Patch f55e4d4. The patch adds explicit cleanup of all previously imported old_data buffers before returning from the error path.
Workarounds
- Disable or restrict use of guest debug features on production s390 KVM hosts until patches are deployed
- Constrain KVM API access using Linux capabilities and cgroup device controllers so untrusted workloads cannot invoke debug ioctls
- Monitor and periodically reboot long-running s390 hypervisors as an interim mitigation to reclaim leaked memory
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
