CVE-2026-89924

CVE-2026-89924

published September 16, 2026

CVSS
—
EPSS
0%
Percentile
10.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Fix old_data leak in guest debug error path

__import_wp_info() allocates a per-watchpoint old_data buffer to back up

the original guest memory contents. If a later watchpoint of the same

KVM_SET_GUEST_DEBUG request fails to import, kvm_s390_import_bp_data()

jumps to the error label, which frees the wp_info array but not the

old_data buffers of the entries that were imported successfully. Up to

MAX_BP_COUNT - 1 buffers of up to MAX_WP_SIZE bytes are leaked per failed

request, and the request can be repeated.

Create error handling for cleaning up all created old_data memory

areas.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00211 · 10.8th percentile
Published
2026-09-16T15:17Z
References (8)
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 10:32Z
    KVM: s390: Fix old_data leak in guest debug error path
    cvelistv5