Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-89924

KVM: s390: Fix old_data leak in guest debug error path

No CVSS scoreEPSS 0.0022 · 12th percentile

Published by the CVE Program (CNA: Linux) at 16 Sept 2026, 10:32 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected 27291e2165b6de70c476b7b675308113edd69a60 to before 124c81ee610e1fbdd93d4399f88d9e28ba97a941 git
  • affected 27291e2165b6de70c476b7b675308113edd69a60 to before e5ae7816e5ad145618f7fd568a0e8a94dd9f81f4 git
  • affected 27291e2165b6de70c476b7b675308113edd69a60 to before c85d402553987777cc4742751437ea5dcbf98a7b git
  • affected 27291e2165b6de70c476b7b675308113edd69a60 to before 5fbf319137735252eefa507193c9a619af5b7457 git
  • affected 27291e2165b6de70c476b7b675308113edd69a60 to before 4048d0a252163084794be3e37995b872c5178913 git
  • affected 27291e2165b6de70c476b7b675308113edd69a60 to before f55e4d415d95342d5753e528e05a1e8623992c3f git
  • affected 27291e2165b6de70c476b7b675308113edd69a60 to before 46cb8a273e2f853f89a78b59dbdff8787b6e1c86 git
  • affected 27291e2165b6de70c476b7b675308113edd69a60 to before aa9c8e8baf1e765fa65b93212522c636f25d846f git
Other versions: unaffected
Linux Linux
  • affected 3.16
  • unaffected before 3.16 semver
  • unaffected 5.10.270 to 5.10.*, inclusive semver
  • unaffected 5.15.221 to 5.15.*, inclusive semver
  • unaffected 6.1.188 to 6.1.*, inclusive semver
  • unaffected 6.6.157 to 6.6.*, inclusive semver
  • unaffected 6.12.110 to 6.12.*, inclusive semver
  • unaffected 6.18.51 to 6.18.*, inclusive semver
  • unaffected 7.2.5 to 7.2.*, inclusive semver
  • unaffected 7.3 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2026-89924
CNA
Linux
Tags
Published
16 Sept 2026
Updated
19 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

  • CISA KEV Not listed.
  • EPSS 0.0022, the 12th percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 16 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.