CVE-2026-89925

CVE-2026-89925 affects the Linux kernel KVM s390 module. The root cause is a memory leak in the guest debug handling path: bp_data is freed via kfree() only in the error case of KVM_SET_GUEST_DEBUG, so every successful KVM_SET_GUEST_DEBUG call leaks the allocation. The practical impact is a per-c...

CVE-2026-89924

This Linux kernel vulnerability affects the KVM s390 subsystem's guest debug interface. In __import_wp_info(), per-watchpoint old_data buffers are allocated to back up original guest memory contents. When a later watchpoint in the same KVM_SET_GUEST_DEBUG request fails to import, kvm_s390_import_...

CVE-2026-89922

CVE-2026-89922 is a race condition in the Linux kernel's KVM s390 subsystem. The function __import_wp_info() uses kvm_read_guest() to back up guest memory contents of a watchpoint, which resolves memslots via __kvm_memslots(). This call requires holding kvm->srcu (or kvm->slots_lock), but t...

CVE-2026-89923

This is a memory leak in the Linux kernel's KVM s390 module. When a vCPU is destroyed while hardware breakpoints remain armed (the normal case when a VMM exits or crashes), hw_bp_info, hw_wp_info, and old_data buffers are leaked because kvm_s390_clear_bp_data() is only invoked from the guest-debu...

CVE-2026-89921

CVE-2026-89921 affects the Linux kernel KVM s390 architecture. The function __kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack struct kvm_s390_irq, but the full ext substructure is copied into the CPU local variable on injection, leaving ext_params and pad with sta...

CVE-2026-89920

CVE-2026-89920 affects the Linux kernel's KVM s390 subsystem. The vulnerability arises when channel-subsystem damage (CK) machine checks are unnecessarily reinjected into a guest VM, even though the guest channel subsystem is emulated in the userspace VMM. This reinjection causes a kfree of a sta...

CVE-2026-89919

CVE-2026-89919 affects the Linux kernel's KVM s390 subsystem. The keyop function reads kvm->arch.gmap->asce without holding the mmu_lock read-side, unlike every other dat_* consumer in the same file. Because gmap->asce is mutated under write_lock(mmu_lock) by gmap_set_limit(), a concurre...

CVE-2026-89918

CVE-2026-89918 affects the Linux kernel KVM arm64 subsystem. The root cause is a flaw in the TLB invalidation (TLBI) by virtual address range: when the TLBI instruction's range reaches the end of the TTBR1 VA space , the expression base + size wraps around to 0, causing the range comparison to fa...

CVE-2026-89917

A race condition in the Linux kernel's KVM arm64 hypervisor exists between the VNCR TLB invalidation path (which runs under the MMU lock) and vcpu_put() 's VNCR unmapping (which does not). The TOCTOU pattern on the TLB path checks vncr_tlb::cpu before unmapping, while this_cpu_reset_vncr_fixmap()...

CVE-2026-89915

This vulnerability affects the Linux kernel's KVM arm64 subsystem, where a flawed VM-wide VNCR mapping counter is used to decide whether an L1-provided VNCR page is mapped in L0 during TLB invalidation. The counter can result in missed TLB invalidations , and fails when an L1 vCPU invalidates its...

CVE-2026-89916

CVE-2026-89916 is a race condition in the Linux kernel's KVM arm64 subsystem where VNCR TLB invalidation did not participate in the MMU invalidation retry mechanism. When one vCPU invalidates a page via TLBI S1E2 while another vCPU is concurrently faulting in the same page, the faulting vCPU can ...

CVE-2026-89914

CVE-2026-89914 affects the Linux kernel's KVM arm64 component. When the decode_range_tlbi() helper was moved to support S1 TLBI (translation lookaside buffer invalidation), the required sign extension of the virtual address was omitted. This causes physical address (PA) bit overflow when the rang...

CVE-2026-89913

CVE-2026-89913 affects the Linux kernel in the KVM arm64 vgic-v3 subsystem. The function vgic_v3_save_pending_tables() iterates the LPI xarray via xa_for_each() and dereferences struct vgic_irq without holding a stable reference. The xarray iterator provides only temporary RCU coverage, which is ...

CVE-2026-89912

CVE-2026-89912 affects the Linux kernel in the KVM arm64 vgic-its subsystem. When a guest issues MAPC with V=0 , the ite->collection pointer is nulled while the ITE remains on the device's ITT list. The function vgic_its_save_ite() then dereferences this NULL pointer unconditionally when the V...

CVE-2026-89911

CVE-2026-89911 affects the KVM arm64 subsystem of the Linux kernel. The root cause is an integer overflow in the handling of TLB Invalidation by Range (TLBI) : because the TLBI range can be encoded with a large value based on an arbitrary virtual address, a guest can trigger an overflow if the hy...

CVE-2026-89909

CVE-2026-89909 is a resource leak in the Linux kernel 's LoongArch KVM module. When kvm_loongarch_init() calls kvm_loongarch_env_init() to allocate per-CPU kvm_context (vmcs), kvm_loongarch_ops, and register perf callbacks, a subsequent failure in kvm_init() causes these resources to be leaked be...

CVE-2026-89910

CVE-2026-89910 affects the Linux kernel on LoongArch architecture within the KVM subsystem. The vulnerable component is the stack variable vector[] in the function dmsintc_inject_irq() , which is sometimes used without being initialized, potentially leading to information disclosure (uninitialize...

CVE-2026-89908

In the Linux kernel LoongArch KVM subsystem, kvm_arch_prepare_memory_region() computes a memslot's arch.flags (KVM_MEM_HUGEPAGE_CAPABLE / KVM_MEM_HUGEPAGE_INCAPABLE) only for KVM_MR_CREATE and KVM_MR_MOVE, returning early for all other changes. Because the generic code allocates a zeroed memslot ...

CVE-2026-89906

CVE-2026-89906 affects the LoongArch BPF JIT in the Linux kernel. The jump offset calculation for tail calls used a stale prior-pass code stride to derive branch distances, which can produce wrong branch offsets and cause soft lockups when extra JIT passes are triggered. The fix recalculates the ...

CVE-2026-89907

CVE-2026-89907 affects the Linux kernel on the LoongArch architecture in the KVM EIOINTC MSI routing path. The function pch_msi_set_irq() passes user-supplied MSI data directly to eiointc_set_irq() without validating it against the 256-entry EIOINTC_IRQS limit. A value of 256 or greater causes ou...