CVE-2026-89923

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM s390 architecture where guest debug data is not properly freed when a vCPU is destroyed. The function kvm s390 clear bp data() is only triggered when user space modifies or disables debugging via kvm arch vcpu ioctl set guest debug(). If a vCPU is destroyed while hardware breakpoints are still active—which occurs during VMM exits or crashes—the system leaks hw bp info, hw wp info, and old data buffers. This memory leak is bounded by MAX BP COUNT (approximately 8 KiB per vCPU) but can grow unbounded over the lifetime of the VM. Because allocations use GFP KERNEL ACCOUNT, the memory charge can persist after the process exits, pinning dying memory control groups (memcgs).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.