CVE-2026-74514

A flaw was found in the KVM (Kernel-based Virtual Machine) s390 PCI component. Incorrect memory accounting in the account_mem() and unaccount_mem() functions, specifically related to the handling of pinned and unpinned pages, can lead to a resource leak. This occurs because the reference count for user structures is not properly decremented, and memory accounting might be performed in a different process context than the one that originally pinned the pages. This issue could potentially lead to resource exhaustion, resulting in a Denial of Service (DoS) for the system.

This vulnerability is rated as having a Low impact because exploitation is constrained to IBM Z (s390x) environments utilizing KVM with PCI device pass-through and requires local execution privileges. Systems running on other architectures or installations without KVM PCI assignments are unaffected by this defect. In affected configurations, an unprivileged local user could trigger memory accounting leaks that gradually deplete system resources, resulting in a denial-of-service condition without compromising data confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.