CVE-2026-80684 (GCVE-0-2026-80684)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:52 – Updated: 2026-08-29 06:22
VLAI
Title
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when dereferenced in kvm_zpci_set_airq(). Add a NULL check and free the previously allocated AISB bit and zdev->aisb on failure.
Severity
9.3 (Critical)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 96099486b63985801c9c6ef22505e9aa635b2d20 (git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 0a95abe964400771ad82b027d7b84a0d183cd0db (git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < df947d85e164a50a29d43a96e814f69ab1d0f7ed (git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < e137d082325bbcae780087b57501d38585e625d9 (git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < d1a103dc9016c25e7423ce5841a5cc2df76d59f3 (git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 8bf09b9b7d3232806df95f409581f8a9fd99a3fa (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kvm/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "96099486b63985801c9c6ef22505e9aa635b2d20",
              "status": "affected",
              "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
              "versionType": "git"
            },
            {
              "lessThan": "0a95abe964400771ad82b027d7b84a0d183cd0db",
              "status": "affected",
              "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
              "versionType": "git"
            },
            {
              "lessThan": "df947d85e164a50a29d43a96e814f69ab1d0f7ed",
              "status": "affected",
              "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
              "versionType": "git"
            },
            {
              "lessThan": "e137d082325bbcae780087b57501d38585e625d9",
              "status": "affected",
              "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
              "versionType": "git"
            },
            {
              "lessThan": "d1a103dc9016c25e7423ce5841a5cc2df76d59f3",
              "status": "affected",
              "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
              "versionType": "git"
            },
            {
              "lessThan": "8bf09b9b7d3232806df95f409581f8a9fd99a3fa",
              "status": "affected",
              "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kvm/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Fix NULL dereference on AIBV allocation failure\n\nThe airq_iv_create() can return NULL on failure, but the return value was\nnever checked. If it fails, zdev-\u003eaibv will be NULL and fail when\ndereferenced in kvm_zpci_set_airq(). Add a NULL check and free the\npreviously allocated AISB bit and zdev-\u003eaisb on failure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the KVM_S390_ZPCI_OP VM ioctl (kvm_arch_vm_ioctl -\u003e kvm_s390_pci_zpci_op -\u003e kvm_s390_pci_aif_enable), a local syscall on the s390 hypervisor host, not via any network-facing kernel service.\nAC:L - An attacker can reliably trigger airq_iv_create() failure and the subsequent NULL dereference by issuing KVM_S390_ZPCIOP_REG_AEN under controlled host memory pressure or repeated registration attempts while holding a valid passthrough zPCI device context.\nPR:N - A malicious KVM guest with an assigned VFIO zPCI passthrough device can cause QEMU to issue KVM_S390_ZPCIOP_REG_AEN during normal adapter-event setup without possessing any host-root or init-namespace administrative credentials.\nUI:N - Exploitation requires no action by a separate victim user; triggering occurs through the attacker\u0027s own guest workload or VMM issuing the REG_AEN ioctl during standard zPCI passthrough interrupt-forwarding registration.\nS:C - The vulnerable KVM host code executes on behalf of a guest\u0027s passthrough device setup, and the resulting host kernel crash or corrupted global AIFT/GAIT interrupt-forwarding state impacts the hypervisor and resources outside the attacking guest\u0027s security boundary.\nC:H - Before the NULL dereference, unchecked allocation failure still populates host GAIT/summary-bit tables with attacker-influenced interrupt-routing fields, enabling misdelivery or exposure of adapter events intended for other guests or host contexts.\nI:H - Failed AIBV allocation leaves partially written host kernel interrupt-forwarding metadata (GAIT entries, kzdev pointers, summary-bit assignments) under attacker-controlled ioctl parameters, constituting exploitable kernel memory corruption prior to the crash.\nA:H - When zdev-\u003eaibv is NULL, kvm_zpci_set_airq() dereferences zdev-\u003eaibv-\u003evector and airq_iv_end(zdev-\u003eaibv), causing a host kernel oops/panic that denies availability to all VMs on the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:11.509Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/96099486b63985801c9c6ef22505e9aa635b2d20"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a95abe964400771ad82b027d7b84a0d183cd0db"
        },
        {
          "url": "https://git.kernel.org/stable/c/df947d85e164a50a29d43a96e814f69ab1d0f7ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/e137d082325bbcae780087b57501d38585e625d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1a103dc9016c25e7423ce5841a5cc2df76d59f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bf09b9b7d3232806df95f409581f8a9fd99a3fa"
        }
      ],
      "title": "KVM: s390: pci: Fix NULL dereference on AIBV allocation failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80684",
    "datePublished": "2026-08-28T06:52:50.703Z",
    "dateReserved": "2026-08-26T14:34:25.784Z",
    "dateUpdated": "2026-08-29T06:22:11.509Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80684",
      "date": "2026-09-22",
      "epss": "0.00144",
      "percentile": "0.04027"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:55:03.000Z",
      "cve": "CVE-2026-80684",
      "id": "msrc_CVE-2026-80684",
      "initial_release_date": "2026-08-29T01:03:06.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "KVM: s390: pci: Fix NULL dereference on AIBV allocation failure",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80684.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/s390/kvm/pci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "96099486b63985801c9c6ef22505e9aa635b2d20",
                    "status": "affected",
                    "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0a95abe964400771ad82b027d7b84a0d183cd0db",
                    "status": "affected",
                    "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "df947d85e164a50a29d43a96e814f69ab1d0f7ed",
                    "status": "affected",
                    "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e137d082325bbcae780087b57501d38585e625d9",
                    "status": "affected",
                    "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d1a103dc9016c25e7423ce5841a5cc2df76d59f3",
                    "status": "affected",
                    "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8bf09b9b7d3232806df95f409581f8a9fd99a3fa",
                    "status": "affected",
                    "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/s390/kvm/pci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.0"
                  },
                  {
                    "lessThan": "6.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Fix NULL dereference on AIBV allocation failure\n\nThe airq_iv_create() can return NULL on failure, but the return value was\nnever checked. If it fails, zdev-\u003eaibv will be NULL and fail when\ndereferenced in kvm_zpci_set_airq(). Add a NULL check and free the\npreviously allocated AISB bit and zdev-\u003eaisb on failure."
          }
        ],
        "id": "CVE-2026-80684",
        "lastModified": "2026-08-29T07:16:50.990",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-28T08:16:53.857",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0a95abe964400771ad82b027d7b84a0d183cd0db"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8bf09b9b7d3232806df95f409581f8a9fd99a3fa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/96099486b63985801c9c6ef22505e9aa635b2d20"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d1a103dc9016c25e7423ce5841a5cc2df76d59f3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/df947d85e164a50a29d43a96e814f69ab1d0f7ed"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e137d082325bbcae780087b57501d38585e625d9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T10:52:21+00:00",
      "cve": "CVE-2026-80684",
      "id": "CVE-2026-80684",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80684.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:09:52Z",
      "cve": "CVE-2026-80684",
      "id": "CVE-2026-80684",
      "initial_release_date": "2026-08-28T16:34:13Z",
      "product_status:known_affected": "168",
      "product_status:known_not_affected": "185",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80684",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80684.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.