The Linux kernel vulnerability CVE-2026-72292 affects the KVM s390 subsystem where the function kvm_s390_get_cmma_bits() allocates an output buffer with vmalloc() that does not zero the memory. During a non-peek migration path, the function dat_get_cmma() reports a byte count spanning from the first to last dirty page, but only pages with the CMMA dirty bit set are written to the buffer. Clean and unmapped pages within this span remain uninitialized, yet are copied to user space, leading to disclosure of stale kernel memory. Previously, the buffer was fully populated, so no uninitialized data was exposed. The vulnerability was fixed by switching to vzalloc(), which zeroes the allocated memory, eliminating the leak.

This vulnerability allows a local user or process interacting with the KVM s390 subsystem to read uninitialized kernel memory, potentially disclosing sensitive information from kernel space to user space. There is no indication of remote exploitation or privilege escalation from the provided data.

A fix is available that replaces vmalloc() with vzalloc() in the kvm_s390_get_cmma_bits() function to ensure the allocated buffer is zero-initialized. Users should apply the official Linux kernel updates that include this fix. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.