CVE-2026-72290 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
kvm_s390_gisc_register() registers the guest ISC before pinning the guest interrupt forwarding pages and allocating the AISB bit. If any of the later setup steps fails, the function unwinds the pinned pages and other local state, but does not unregister the GISC reference. Add the missing kvm_s390_gisc_unregister() to the error unwind path.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's KVM implementation for s390 architecture systems, specifically addressing a resource management issue in the guest interrupt handling subsystem. The flaw occurs during the GISC (Guest Interrupt Subsystem Control) registration process where the kernel fails to properly clean up references when the AIF (Advanced Interrupt Facility) enable operation encounters an error condition. This represents a classic reference counting error that can lead to memory leaks and resource exhaustion within virtualized environments.
The technical implementation involves the kvm_s390_gisc_register() function which manages guest interrupt forwarding for s390 virtual machines. During normal operation, this function performs several critical steps including registering the guest ISC, pinning interrupt forwarding pages in memory, and allocating AISB (Advanced Interrupt Subsystem Block) bits for the guest's interrupt handling. When any of these subsequent initialization steps fail, the error handling path properly cleans up the pinned memory pages and local state variables but omits the crucial step of unregistering the GISC reference that was initially established. This oversight creates a dangling reference that persists in the kernel's resource management tables.
The operational impact of this vulnerability manifests as a gradual accumulation of unreleased GISC references within the kernel's memory space, leading to potential resource exhaustion over time. In virtualized environments where multiple guests are actively using interrupt forwarding mechanisms, repeated failures during AIF enable operations can cause progressive memory consumption that may eventually impact system stability and performance. The leak specifically affects systems running KVM on s390 architecture with guest interrupt handling enabled, particularly those utilizing the Advanced Interrupt Facility feature for enhanced interrupt processing capabilities.
This vulnerability aligns with CWE-404, which describes improper resource release or unbalanced resource management, and can be categorized under ATT&CK technique T1490 for resource hijacking through memory exhaustion. The fix implements proper error handling by adding the missing kvm_s390_gisc_unregister() call to the unwind path, ensuring that all allocated references are properly released regardless of whether initialization succeeds or fails. This remediation follows standard kernel programming practices for robust error handling and resource management, maintaining the principle that every resource acquisition must have a corresponding release operation.
The mitigation strategy involves applying the kernel patch that ensures proper reference counting during GISC registration failure scenarios, with no additional configuration changes required for system administrators. The fix is specific to s390 architecture KVM implementations and addresses the root cause by guaranteeing that interrupt subsystem references are properly cleaned up even when setup operations encounter errors. This prevents the accumulation of stale references that could otherwise lead to performance degradation or potential denial-of-service conditions in heavily loaded virtualized environments where interrupt handling is frequently utilized.