CVE-2026-89923 Linux CVE debrief

Who should care

Defenders responsible for Linux systems, particularly those using KVM: s390 configurations, should assess exposure and prioritize patching affected versions. They should review compensating controls for exposed systems while remediation is scheduled and verified. Defenders should prioritize verifying and applying patches for affected Linux kernel versions, particularly those with KVM: s390 configurations.

Why it matters

CVE-2026-89923 is a Linux kernel vulnerability that allows guest debug data to leak on vCPU destruction, potentially leading to memory leaks and performance impacts. Defenders should prioritize verifying and applying patches for affected versions.

• Memory leaks due to uncleared debug data on vCPU destruction
• Potential for increased memory usage and performance impact
• Need for verification and patching of affected Linux kernel versions
• Importance of monitoring Linux system configurations for KVM: s390

Technical summary

The Linux kernel vulnerability CVE-2026-89923 occurs because kvm_s390_clear_bp_data() is not called when a vCPU is destroyed with hardware breakpoints still armed. This leads to memory leaks of hw_bp_info, hw_wp_info, and old_data buffers. The issue is resolved by unconditionally clearing debug data on vCPU destruction. A Linux kernel vulnerability allows guest debug data to leak on vCPU destruction. This issue arises because the kvm_s390_clear_bp_data() function is only called when user space changes or disables debugging, not when a vCPU is destroyed with hardware breakpoints still armed.

Defensive priority

Defenders should prioritize verifying and applying patches for affected Linux kernel versions, particularly those with KVM: s390 configurations. They should also review and update their inventory of Linux systems to ensure all are running patched versions.

Recommended defensive actions

• Verify and apply patches for affected Linux kernel versions
• Review and update inventory of Linux systems
• Monitor Linux system configurations for KVM: s390
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fix. The Linux kernel's official Git repository contains commits addressing the issue. Defenders should verify the official advisory for affected scope, severity, and vendor guidance. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified. The vulnerability allows guest debug data to leak on vCPU destruction due to uncleared debug data, leading to memory leaks bounded by MAX_BP_COUNT entries (

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.