CVE-2026-89925: Linux Kernel KVM Memory Leak Vulnerability

CVE-2026-89925 Overview

CVE-2026-89925 is a memory leak vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the s390 architecture. The flaw resides in the guest debug handling code path, where the bp_data buffer is only released via kfree(bp_data) on the error path. Each successful KVM_SET_GUEST_DEBUG ioctl invocation leaks the associated bp_data allocation. Over time, repeated debug operations against KVM guests exhaust kernel memory on affected s390 hosts. The issue has been resolved upstream through multiple stable-kernel backport patches.

Critical Impact
Repeated KVM_SET_GUEST_DEBUG calls leak kernel memory on s390 KVM hosts, enabling gradual resource exhaustion that can degrade hypervisor stability.

Affected Products

Linux kernel (KVM subsystem on s390 architecture)
Distributions shipping vulnerable Linux kernel versions on IBM Z / LinuxONE hosts
Virtualization platforms using KVM on s390 for guest debugging workflows

Discovery Timeline

2026-09-16 - CVE-2026-89925 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89925

Vulnerability Analysis

The vulnerability is a classic memory leak in the KVM s390 guest debug handler. When userspace invokes the KVM_SET_GUEST_DEBUG ioctl to configure breakpoints on a virtual CPU, the kernel allocates a bp_data buffer to hold breakpoint descriptors. The original code path only released this buffer via kfree(bp_data) when an error occurred. Successful invocations returned without freeing the allocation. Because KVM_SET_GUEST_DEBUG can be called repeatedly during a guest's lifetime, each successful call leaked a fresh bp_data allocation into kernel memory.

Root Cause

The root cause is missing cleanup logic on the success path of the guest debug configuration routine. The kfree(bp_data) call was scoped only to the error-handling branch. This is a resource-management defect where allocated memory outlives its intended lifetime because ownership is not correctly transferred or released after the buffer's contents are consumed.

Attack Vector

Exploitation requires the ability to issue KVM_SET_GUEST_DEBUG ioctls against a KVM virtual CPU file descriptor on an s390 host. This capability is typically held by the hypervisor management process (for example, QEMU) or by a local user with access to /dev/kvm. A malicious or buggy userspace component can trigger the leak by repeatedly setting guest debug state, gradually consuming kernel memory. Sustained exploitation can lead to denial-of-service conditions on the host by exhausting available kernel allocations.

No verified exploitation code is public. The upstream fix ensures bp_data is released on both success and error paths. Technical details of the correction are visible in the stable kernel patch series referenced below.

Detection Methods for CVE-2026-89925

Indicators of Compromise

Sustained growth of kernel slab memory (kmalloc-* caches) on s390 KVM hosts running guests that use debugging features
Increasing SUnreclaim values in /proc/meminfo correlated with guest debug activity
Out-of-memory (OOM) events on the hypervisor host without corresponding growth in userspace RSS
Guest management tooling repeatedly invoking KVM_SET_GUEST_DEBUG against long-running VCPUs

Detection Strategies

Compare running kernel version on s390 hosts against the fixed commits (121ea1d, 39e7ceb, 44bf379, 581be9f, 58b1b72, 5940418, 9071f75, fc2034c) to identify unpatched systems
Use kernel memory profiling tools such as slabtop, kmemleak, or eBPF-based tracers to observe unexplained growth in KVM-related allocations
Trace ioctl invocations against /dev/kvm file descriptors with strace or bpftrace to correlate debug operations with memory growth

Monitoring Recommendations

Alert on progressive Slab and SUnreclaim growth on IBM Z virtualization hosts that lacks a corresponding userspace explanation
Collect and normalize host telemetry into a centralized data lake to correlate hypervisor memory pressure with guest debug workflows
Monitor for OOM-killer activity targeting the hypervisor userspace process (for example, qemu-system-s390x) as a symptom of kernel-side exhaustion

How to Mitigate CVE-2026-89925

Immediate Actions Required

Inventory all s390 (IBM Z / LinuxONE) systems running KVM and identify kernels that predate the stable-tree fixes
Apply vendor-supplied kernel updates that include the upstream fix as soon as they are available for your distribution
Restrict access to /dev/kvm to trusted service accounts to reduce local abuse potential
Restart long-running s390 KVM hosts after patching to reclaim memory already leaked prior to the fix

Patch Information

The fix has been backported across multiple Linux stable branches. Refer to the corresponding kernel commits for verification:

Workarounds

Avoid using KVM_SET_GUEST_DEBUG against long-lived s390 guests until the patched kernel is deployed
Schedule periodic reboots or live migrations of hypervisor hosts to reclaim leaked kernel memory
Limit guest debugging to short-lived VMs or dedicated debug hosts that can be recycled after use
Enforce strict access controls on /dev/kvm so only vetted virtualization services can issue debug ioctls