CVE-2026-72292: KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Initialize KVMS390GETCMMABITS memory
kvms390getcmmabits() allocates its output buffer with vmalloc(), which does not zero the returned pages:
values = vmalloc(args->count);
In the non-peek (migration) path, datgetcmma() reports a byte count spanning from the first to the last dirty page, but datgetcmmapte() writes values[gfn - start] only for pages whose CMMA dirty bit is set. The walk uses DATWALKIGNHOLES, so clean and unmapped pages that lie between two dirty pages within the reported span are visited but never store their byte. Those gaps (up to KVMS390MAXBITDISTANCE pages each) stay uninitialized yet fall inside [0, count) and are copied out by copytouser(), disclosing stale kernel memory to user space.
Before the switch to the new gmap implementation the buffer was fully populated for every gfn in the span, so no uninitialized bytes were exposed; the dirty-only walk introduced the leak.
Use vzalloc() so the gaps read back as zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In kvm_s390_get_cmma_bits(), replace the vmalloc(args->count) allocation with vzalloc(args->count) so gaps between dirty pages are initialized to zero before being copied to user space.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72292?
CVE-2026-72292 has a risk score of 33, indicating a low to moderate impact on system security.
How do I fix CVE-2026-72292?
To fix CVE-2026-72292, update your Linux kernel to a patched version that addresses the vulnerability.
What systems are affected by CVE-2026-72292?
CVE-2026-72292 affects systems using the Linux kernel with KVM virtualization, particularly on s390 architecture.
What type of vulnerability is CVE-2026-72292?
CVE-2026-72292 is a security flaw in the KVM component of the Linux kernel related to memory initialization.
Is CVE-2026-72292 exploitable?
Yes, if unaddressed, CVE-2026-72292 could potentially allow an attacker to exploit uninitialized memory.