CVE-2026-89923

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Free guest debug data on vcpu destroy

kvm_s390_clear_bp_data() is only called from

kvm_arch_vcpu_ioctl_set_guest_debug(), i.e. when user space changes or

disables debugging. A vCPU that is destroyed while hardware breakpoints

are still armed - the normal case when the VMM just exits or crashes -

leaks hw_bp_info, hw_wp_info and all old_data buffers, since generic KVM

frees the vCPU right after kvm_arch_vcpu_destroy().

That is bounded by MAX_BP_COUNT entries, so roughly 8 KiB per vCPU, but

it is unbounded over VM lifetimes. The allocations are

GFP_KERNEL_ACCOUNT, so the charge also outlives the exiting process and

pins dying memcgs.

Fix by clearing the debug data on vCPU destruction. Calling it

unconditionally is fine: struct kvm_vcpu is zero allocated, so for a vCPU

that never enabled debugging the counters are 0 and the pointers NULL.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References