CVE-2026-72292
Description
A flaw was found in the kernel. A local user could exploit a vulnerability in the KVM_S390_GET_CMMA_BITS ioctl, specifically within the kvm_s390_get_cmma_bits() function. This function allocates memory without properly initializing all pages, leading to uninitialized memory regions. These uninitialized regions can then be copied to user space, resulting in the disclosure of stale kernel memory.
Statement
An information disclosure flaw of moderate severity was found in the Linux kernel KVM subsystem on s390 systems. The kvm_s390_get_cmma_bits() function, which backs the KVM_S390_GET_CMMA_BITS ioctl used during guest migration, allocated its output buffer with vmalloc() without zeroing the memory. In the migration (non-peek) path, only pages whose CMMA dirty bit is set within the reported range are written into the buffer, so clean or unmapped pages that lie between dirty pages remain uninitialized and are still copied back to user space by copy_to_user(). A local user with access to the KVM ioctl interface on an s390 host could use this to disclose stale kernel memory to user space. All currently supported Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are not affected by this flaw because the vulnerable code is not present in the shipped kernels; the remaining rhel-6-els mapping is out of support scope.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
