# KVM: s390: Fix old_data leak in guest debug error path

CVE record · `CVE-2026-89924`

- **Identifiers:** `CVE-2026-89924`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 16 Sept 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 16 Sept 2026, 10:32 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `27291e2165b6de70c476b7b675308113edd69a60 to before 124c81ee610e1fbdd93d4399f88d9e28ba97a941` (git)
  - affected: `27291e2165b6de70c476b7b675308113edd69a60 to before e5ae7816e5ad145618f7fd568a0e8a94dd9f81f4` (git)
  - affected: `27291e2165b6de70c476b7b675308113edd69a60 to before c85d402553987777cc4742751437ea5dcbf98a7b` (git)
  - affected: `27291e2165b6de70c476b7b675308113edd69a60 to before 5fbf319137735252eefa507193c9a619af5b7457` (git)
  - affected: `27291e2165b6de70c476b7b675308113edd69a60 to before 4048d0a252163084794be3e37995b872c5178913` (git)
  - affected: `27291e2165b6de70c476b7b675308113edd69a60 to before f55e4d415d95342d5753e528e05a1e8623992c3f` (git)
  - affected: `27291e2165b6de70c476b7b675308113edd69a60 to before 46cb8a273e2f853f89a78b59dbdff8787b6e1c86` (git)
  - affected: `27291e2165b6de70c476b7b675308113edd69a60 to before aa9c8e8baf1e765fa65b93212522c636f25d846f` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `3.16`
  - unaffected: `before 3.16` (semver)
  - unaffected: `5.10.270 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.221 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.188 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.157 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.110 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.51 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.5 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0022, the 12th percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 16 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-89924](https://www.cve.org/CVERecord?id=CVE-2026-89924)
- [NVD: CVE-2026-89924](https://nvd.nist.gov/vuln/detail/CVE-2026-89924)

### References from the CNA

- <https://git.kernel.org/stable/c/124c81ee610e1fbdd93d4399f88d9e28ba97a941>
- <https://git.kernel.org/stable/c/e5ae7816e5ad145618f7fd568a0e8a94dd9f81f4>
- <https://git.kernel.org/stable/c/c85d402553987777cc4742751437ea5dcbf98a7b>
- <https://git.kernel.org/stable/c/5fbf319137735252eefa507193c9a619af5b7457>
- <https://git.kernel.org/stable/c/4048d0a252163084794be3e37995b872c5178913>
- <https://git.kernel.org/stable/c/f55e4d415d95342d5753e528e05a1e8623992c3f>
- <https://git.kernel.org/stable/c/46cb8a273e2f853f89a78b59dbdff8787b6e1c86>
- <https://git.kernel.org/stable/c/aa9c8e8baf1e765fa65b93212522c636f25d846f>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-89924>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-89924/>. Everything for agents: <https://agentprime.io/llms.txt>.