CVE-2026-89909
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Free init resources if kvm_init() fails kvm_loongarch_init() calls kvm_loongarch_env_init() to allocate the per-CPU kvm_context (vmcs) and kvm_loongarch_ops and to register the perf callbacks, and then calls kvm_init(). If kvm_init() fails its result is returned directly, but since module_init() does not run the module_exit() stuff on failure, so kvm_loongarch_env_exit() is never called and those resources are leaked. So call kvm_loongarch_env_exit() when kvm_init() fails, matching the teardown-on-failure pattern used by riscv_kvm_init().
Affected versions
Linux kernel versions
6.7
and later are affected. Fixed in
6.12.110,
6.18.51,
7.2.5,
7.3-rc2
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-89909?
CVE-2026-89909 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.7 onward and has been patched in 6.12.110, 6.18.51, 7.2.5 and others. CVE-2026-89909 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-89909?
Yes. CVE-2026-89909 has been patched. Fixed versions include 6.12.110, 6.18.51, 7.2.5 and others. If you are running Linux kernel 6.7 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-89909 actively exploited?
No. CVE-2026-89909 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.