CVE-2026-72292

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory

kvm_s390_get_cmma_bits() allocates its output buffer with vmalloc(),

which does not zero the returned pages:

values = vmalloc(args->count);

In the non-peek (migration) path, dat_get_cmma() reports a byte count

spanning from the first to the last dirty page, but __dat_get_cmma_pte()

writes values[gfn - start] only for pages whose CMMA dirty bit is set.

The walk uses DAT_WALK_IGN_HOLES, so clean and unmapped pages that lie

between two dirty pages within the reported span are visited but never

store their byte. Those gaps (up to KVM_S390_MAX_BIT_DISTANCE pages

each) stay uninitialized yet fall inside [0, count) and are copied out

by copy_to_user(), disclosing stale kernel memory to user space.

Before the switch to the new gmap implementation the buffer was fully

populated for every gfn in the span, so no uninitialized bytes were

exposed; the dirty-only walk introd

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References