---
id: CVE-2026-89923
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: s390: Free guest debug data on vcpu destroy

  kvm_s390_clear_bp_data() is only called from
  kvm_arch_vcpu_ioctl_set_guest_debug(), i.e
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: s390: Free guest debug data on vcpu destroy

  kvm_s390_clear_bp_data() is only called from
  kvm_arch_vcpu_ioctl_set_guest_debug(), i.e. when user space changes or
  di…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 27291e2165b6de70c476b7b675308113edd69a60 <
    053f2068cf9b0654b651fed5ad7649d3deb982bf
  - >-
    Linux >= 27291e2165b6de70c476b7b675308113edd69a60 <
    6c996b12bbe4a6023076e8eee3cfaf2cc99db76c
  - >-
    Linux >= 27291e2165b6de70c476b7b675308113edd69a60 <
    d6280fc540d8f4653c9b54a78cb747e128070f5e
  - >-
    Linux >= 27291e2165b6de70c476b7b675308113edd69a60 <
    544a5a665019cef394ce8bda97fa7a2cab253781
  - >-
    Linux >= 27291e2165b6de70c476b7b675308113edd69a60 <
    9a32c4c6a6c23b7f5bf765eb5b83ba7f64a8ec63
  - >-
    Linux >= 27291e2165b6de70c476b7b675308113edd69a60 <
    b5acacfdb8966abff91836c1c5bd7da59d8a526e
  - >-
    Linux >= 27291e2165b6de70c476b7b675308113edd69a60 <
    e4d8b7f176b976474e0800ba71ee2dfa3ce263c9
  - >-
    Linux >= 27291e2165b6de70c476b7b675308113edd69a60 <
    e7f698b09d4a7c36b299acf680fc50fe868e2bcd
  - Linux 3.16
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T11:17:01.397'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89923'
references:
  - url: 'https://git.kernel.org/stable/c/053f2068cf9b0654b651fed5ad7649d3deb982bf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/544a5a665019cef394ce8bda97fa7a2cab253781'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6c996b12bbe4a6023076e8eee3cfaf2cc99db76c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9a32c4c6a6c23b7f5bf765eb5b83ba7f64a8ec63'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b5acacfdb8966abff91836c1c5bd7da59d8a526e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d6280fc540d8f4653c9b54a78cb747e128070f5e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e4d8b7f176b976474e0800ba71ee2dfa3ce263c9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e7f698b09d4a7c36b299acf680fc50fe868e2bcd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.971Z'
epss: 0.0021
epssPercentile: 0.11554
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Free guest debug data on vcpu destroy

kvm_s390_clear_bp_data() is only called from
kvm_arch_vcpu_ioctl_set_guest_debug(), i.e. when user space changes or
disables debugging. A vCPU that is destroyed while hardware breakpoints
are still armed - the normal case when the VMM just exits or crashes -
leaks hw_bp_info, hw_wp_info and all old_data buffers, since generic KVM
frees the vCPU right after kvm_arch_vcpu_destroy().

That is bounded by MAX_BP_COUNT entries, so roughly 8 KiB per vCPU, but
it is unbounded over VM lifetimes. The allocations are
GFP_KERNEL_ACCOUNT, so the charge also outlives the exiting process and
pins dying memcgs.

Fix by clearing the debug data on vCPU destruction. Calling it
unconditionally is fine: struct kvm_vcpu is zero allocated, so for a vCPU
that never enabled debugging the counters are 0 and the pointers NULL.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.