CVE-2026-23029

Vulnerability

Overview

In the Linux kernel's KVM subsystem for LoongArch, the function kvm_eiointc_destroy() is responsible for cleaning up a kvm_device created via kvm_ioctl_create_device(). However, the destroy function does not free the allocated kvm_device struct itself, leading to a memory leak [1].

Exploitation

Details

To exploit this vulnerability, an attacker would need the ability to create and destroy KVM devices on a LoongArch system. This typically requires local access with sufficient privileges to interact with the KVM subsystem, such as through the /dev/kvm interface. The leak occurs each time a KVM device of type eiointc is created and then destroyed, gradually consuming kernel memory.

Impact

Over time, repeated exploitation could exhaust kernel memory, potentially leading to denial-of-service conditions. The vulnerability does not directly provide code execution or privilege escalation, but memory exhaustion can degrade system performance or cause instability.

Mitigation

The issue has been fixed in the Linux kernel stable commit referenced [1]. Users are advised to apply the latest kernel updates to prevent the memory leak. No workaround is available besides updating the kernel.