« Volver al listado

CVE-2026-72292

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory

kvm_s390_get_cmma_bits() allocates its output buffer with vmalloc(), which does not zero the returned pages:

In the non-peek (migration) path, dat_get_cmma() reports a byte count spanning from the first to the last dirty page, but __dat_get_cmma_pte() writes values[gfn - start] only for pages whose CMMA dirty bit is set. The walk uses DAT_WALK_IGN_HOLES, so clean and unmapped pages that lie between two dirty pages within the reported span are visited but never store their byte.

Leer descripción completaMostrar menos

Those gaps (up to KVM_S390_MAX_BIT_DISTANCE pages each) stay uninitialized yet fall inside [0, count) and are copied out by copy_to_user(), disclosing stale kernel memory to user space.

Before the switch to the new gmap implementation the buffer was fully populated for every gfn in the span, so no uninitialized bytes were exposed; the dirty-only walk introduced the leak.

Use vzalloc() so the gaps read back as zero.

Detalles técnicos trazas, registros y código del informe original
	values = vmalloc(args->count);

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72292",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e38c884df92119d96f652d51f82661dd2fc0b885",
              "lessThan": "a4a19941ccb2164edc3491faa5ac5df82e94b363",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e38c884df92119d96f652d51f82661dd2fc0b885",
              "lessThan": "c7dda3d0f869dc97223448a06c9a2e5235928e48",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/s390/kvm/kvm-s390.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/s390/kvm/kvm-s390.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:22:01.377",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/a4a19941ccb2164edc3491faa5ac5df82e94b363",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c7dda3d0f869dc97223448a06c9a2e5235928e48",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory\n\nkvm_s390_get_cmma_bits() allocates its output buffer with vmalloc(),\nwhich does not zero the returned pages:\n\n\tvalues = vmalloc(args->count);\n\nIn the non-peek (migration) path, dat_get_cmma() reports a byte count\nspanning from the first to the last dirty page, but __dat_get_cmma_pte()\nwrites values[gfn - start] only for pages whose CMMA dirty bit is set.\nThe walk uses DAT_WALK_IGN_HOLES, so clean and unmapped pages that lie\nbetween two dirty pages within the reported span are visited but never\nstore their byte.  Those gaps (up to KVM_S390_MAX_BIT_DISTANCE pages\neach) stay uninitialized yet fall inside [0, count) and are copied out\nby copy_to_user(), disclosing stale kernel memory to user space.\n\nBefore the switch to the new gmap implementation the buffer was fully\npopulated for every gfn in the span, so no uninitialized bytes were\nexposed; the dirty-only walk introduced the leak.\n\nUse vzalloc() so the gaps read back as zero."
    }
  ],
  "lastModified": "2026-08-17T06:18:32.017",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}