CVE-2026-72292

A flaw was found in the kernel. A local user could exploit a vulnerability in the KVM_S390_GET_CMMA_BITS ioctl, specifically within the kvm_s390_get_cmma_bits() function. This function allocates memory without properly initializing all pages, leading to uninitialized memory regions. These uninitialized regions can then be copied to user space, resulting in the disclosure of stale kernel memory.

An information disclosure flaw of moderate severity was found in the Linux kernel KVM subsystem on s390 systems. The kvm_s390_get_cmma_bits() function, which backs the KVM_S390_GET_CMMA_BITS ioctl used during guest migration, allocated its output buffer with vmalloc() without zeroing the memory. In the migration (non-peek) path, only pages whose CMMA dirty bit is set within the reported range are written into the buffer, so clean or unmapped pages that lie between dirty pages remain uninitialized and are still copied back to user space by copy_to_user(). A local user with access to the KVM ioctl interface on an s390 host could use this to disclose stale kernel memory to user space. All currently supported Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are not affected by this flaw because the vulnerable code is not present in the shipped kernels; the remaining rhel-6-els mapping is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.