CVE-2026-89924

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Fix old_data leak in guest debug error path

__import_wp_info() allocates a per-watchpoint old_data buffer to back up

the original guest memory contents. If a later watchpoint of the same

KVM_SET_GUEST_DEBUG request fails to import, kvm_s390_import_bp_data()

jumps to the error label, which frees the wp_info array but not the

old_data buffers of the entries that were imported successfully. Up to

MAX_BP_COUNT - 1 buffers of up to MAX_WP_SIZE bytes are leaked per failed

request, and the request can be repeated.

Create error handling for cleaning up all created old_data memory

areas.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References