CVE intelligence

CVE-2026-89909

Vulnerability intelligence

Published Sep 16, 2026Sources checked Oct 21, 2026

N/ACVSS not listedScore unavailable

What this means

Review the available evidence

CVE-2026-89909. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-89909?

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Free init resources if kvm_init() fails

kvm_loongarch_init() calls kvm_loongarch_env_init() to allocate the per-CPU kvm_context (vmcs) and kvm_loongarch_ops and to register the perf callbacks, and then calls kvm_init(). If kvm_init() fails its result is returned directly, but since module_init() does not run the module_exit() stuff on failure, so kvm_loongarch_env_exit() is never called and those resources are leaked.

So call kvm_loongarch_env_exit() when kvm_init() fails, matching the teardown-on-failure pattern used by riscv_kvm_init().

Source: NVD