CVE-2026-89909: Linux vulnerability

CVE-2026-89909: LoongArch: KVM: Free init resources if kvm_init() fails

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Free init resources if kvm_init() fails kvm_loongarch_init() calls kvm_loongarch_env_init() to allocate the per-CPU kvm_context (vmcs) and kvm_loongarch_ops and to register the perf callbacks, and then calls kvm_init(). If kvm_init() fails its result is returned directly, but since module_init() does not run the module_exit() stuff on failure, so kvm_loongarch_env_exit() is never called and those resources are leaked. So call kvm_loongarch_env_exit() when kvm_init() fails, matching the teardown-on-failure pattern used by riscv_kvm_init().

UnknownCVSS not scoredNot KEV-listedUpdatedOct 19, 2026, 08:54 UTC (UTC+00:00)

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-89909 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Sep 16, 2026, 10:32 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

0ADP providers

5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
Sep 11, 2026, 19:38 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
Sep 16, 2026, 10:32 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Oct 19, 2026, 08:54 UTC (UTC+00:00)

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/6bbbd7b719233645a5c120557a9ca1422e6b7a48CVE reference, Linux
https://git.kernel.org/stable/c/6b78786ee7260d9818cf1d7a245b7a655ef83076CVE reference, Linux
https://git.kernel.org/stable/c/3bf6f5e2e1007d38a5f35bd37e94ab645a0c40bcCVE reference, Linux
https://git.kernel.org/stable/c/f7a1064cce3b100b54780c68529176232d8eb01eCVE reference, Linux

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinux2bd6ac68726131da32ace9717aa63ff68cf6605c, 2bd6ac68726131da32ace9717aa63ff68cf6605c, 2bd6ac68726131da32ace9717aa63ff68cf6605c, 2bd6ac68726131da32ace9717aa63ff68cf6605cunaffected

LinuxLinux6.7, 0, 6.12.110, 6.18.51, 7.2.5, 7.3affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.