CVE-2026-72292

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM s390 implementation where the kvm s390 get cmma bits() function allocates an output buffer using vmalloc(), which does not zero the returned pages. In the non-peek migration path, dat get cmma() reports a byte count from the first to the last dirty page, but dat get cmma pte() only writes to the buffer for pages where the CMMA dirty bit is set. Because the process uses DAT WALK IGN HOLES, clean or unmapped pages between dirty pages remain uninitialized. These gaps are subsequently copied to user space via copy to user(), leading to the disclosure of stale kernel memory. This leak was introduced by the transition to a dirty-only walk in the new gmap implementation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.