CVE-2026-89924

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the KVM s390 architecture, a memory leak occurs in the guest debug error path. The import wp info() function allocates an old data buffer for each watchpoint to back up original guest memory contents. When a KVM SET GUEST DEBUG request fails during the import of a subsequent watchpoint, the kvm s390 import bp data() function triggers an error path that frees the wp info array but fails to free the old data buffers of previously successful entries. This allows for the leakage of up to MAX BP COUNT - 1 buffers of up to MAX WP SIZE bytes per failed request, and the process can be repeated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.