CVE-2026-23027

Vulnerability

In the Linux kernel's LoongArch KVM implementation, the function kvm_pch_pic_destroy() does not free the kvm_device struct that was allocated in kvm_ioctl_create_device(). This omission causes a memory leak each time a device is destroyed, as the destroy callback is expected to release the device structure itself [1].

Exploitation

An attacker with the ability to create and destroy KVM devices on a LoongArch system can repeatedly trigger this leak. No special privileges beyond access to the KVM device interface are required, though the attack surface is limited to systems using the LoongArch architecture with the PCH-PIC device model.

Impact

Repeated exploitation can exhaust kernel memory, potentially leading to denial of service (system stability or availability. The leak does not directly allow code execution or privilege escalation, but resource exhaustion can disrupt other processes.

Mitigation

The fix is included in the Linux kernel stable tree as commit fc53a66227af. Users should apply the patch or update to a kernel version containing this commit. No workaround is available other than avoiding repeated device creation/destruction cycles.