CVE-2026-72292

Received Received - Intake

Memory Leak in Linux Kernel KVM s390 Module

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory kvm_s390_get_cmma_bits() allocates its output buffer with vmalloc(), which does not zero the returned pages: values = vmalloc(args->count); In the non-peek (migration) path, dat_get_cmma() reports a byte count spanning from the first to the last dirty page, but __dat_get_cmma_pte() writes values[gfn - start] only for pages whose CMMA dirty bit is set. The walk uses DAT_WALK_IGN_HOLES, so clean and unmapped pages that lie between two dirty pages within the reported span are visited but never store their byte. Those gaps (up to KVM_S390_MAX_BIT_DISTANCE pages each) stay uninitialized yet fall inside [0, count) and are copied out by copy_to_user(), disclosing stale kernel memory to user space. Before the switch to the new gmap implementation the buffer was fully populated for every gfn in the span, so no uninitialized bytes were exposed; the dirty-only walk introduced the leak. Use vzalloc() so the gaps read back as zero.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72292

EUVD

EUVD-2026-59191

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory disclosure issue in the KVM (Kernel-based Virtual Machine) module for s390 architecture. The function kvm_s390_get_cmma_bits() allocates memory using vmalloc(), which does not zero out the allocated pages. When reporting dirty pages during migration, gaps between dirty pages are not initialized, leading to uninitialized memory being copied to user space via copy_to_user().

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM s390 implementation and does not have a direct network detection method. Detection requires checking the kernel version and verifying if the vulnerable code path exists. Use uname -a to check the kernel version and grep for the affected function in the kernel source.

Impact Analysis

This vulnerability could allow an attacker with local access to read uninitialized kernel memory. This may expose sensitive information such as passwords, encryption keys, or other confidential data stored in memory. The impact is limited to systems running the affected Linux kernel versions with KVM enabled for s390 architecture.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, potentially violating compliance requirements under GDPR, HIPAA, or other regulations that mandate protection of personal health or financial information. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Apply the kernel patch that replaces vmalloc() with vzalloc() in the kvm_s390_get_cmma_bits() function. Update your Linux kernel to a version containing the fix. If immediate patching is not possible, restrict access to KVM s390 features or disable KVM virtualization on affected systems.

Hi! I’m here to help you understand CVE-2026-72292. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70