GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74515 (GCVE-0-2026-74515)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:38
VLAI
Title
KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled The MPCIFC instruction doesn't allow registering adapter interrupts without first unregistering. So reject any request to enable interrupt forwarding if its already enabled for the zPCI device. This also fixes overwriting and thus leaking resources when the ioctl is called multiple times for the same device.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70 (git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 78d9648e7e960546d5b72504a0b0358cd8bb1e9d (git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 6be1ff49ba81f96a6fa55915e6d920be43ac57cc (git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 6837f0ae85fd54cf64c8a0c7c530bba2fae0a207 (git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 591952b63a9f976da7d49f719f36ec826ee2a575 (git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 8fa01be5a6149404adb82c0979a78f6347edd3ef (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kvm/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70",
              "status": "affected",
              "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
              "versionType": "git"
            },
            {
              "lessThan": "78d9648e7e960546d5b72504a0b0358cd8bb1e9d",
              "status": "affected",
              "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
              "versionType": "git"
            },
            {
              "lessThan": "6be1ff49ba81f96a6fa55915e6d920be43ac57cc",
              "status": "affected",
              "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
              "versionType": "git"
            },
            {
              "lessThan": "6837f0ae85fd54cf64c8a0c7c530bba2fae0a207",
              "status": "affected",
              "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
              "versionType": "git"
            },
            {
              "lessThan": "591952b63a9f976da7d49f719f36ec826ee2a575",
              "status": "affected",
              "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
              "versionType": "git"
            },
            {
              "lessThan": "8fa01be5a6149404adb82c0979a78f6347edd3ef",
              "status": "affected",
              "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kvm/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Reject adapter interrupt forwarding if already enabled\n\nThe MPCIFC instruction doesn\u0027t allow registering adapter interrupts without\nfirst unregistering. So reject any request to enable interrupt forwarding\nif its already enabled for the zPCI device. This also fixes overwriting and\nthus leaking resources when the ioctl is called multiple times for the same\ndevice."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the KVM_S390_ZPCI_OP VM ioctl in arch/s390/kvm/kvm-s390.c; on IBM Z with zPCI passthrough, QEMU forwards guest mpcifc adapter-interrupt registration to this local ioctl path, not over the network.\nAC:L - An attacker with an assigned zPCI device can call KVM_S390_ZPCIOP_REG_AEN twice in a row without racing or special memory layout; each duplicate call deterministically re-enters kvm_s390_pci_aif_enable() and overwrites host bookkeeping.\nPR:L - Exploitation requires a KVM VM file descriptor and a VFIO-assigned zPCI device, i.e. control of the guest/VMM process (typical cloud tenant or qemu user), not init-namespace root; this cannot be reached from an unprivileged user namespace alone.\nUI:N - Once zPCI passthrough is configured, the guest or its VMM can issue duplicate registration on its own; no additional host administrator or victim user action is needed beyond normal device setup.\nS:C - A guest-triggered ioctl corrupts host-owned AIFT/GAITE state outside the VM security boundary, leaving orphaned summary-index entries that the host interrupt path later dereferences in hypervisor context.\nC:H - Duplicate enable overwrites zdev-\u003eaisb and leaks earlier GAITE/AIBV resources; on teardown aift-\u003ekzdev[orphaned_si] still points at freed kvm_zdev/kvm, so aen_host_forward() performs UAF reads of host hypervisor memory.\nI:H - Stale orphaned GAITE entries retain guest-chosen physical addresses and dangling kzdev pointers; aen_host_forward() can execute set_bit_inv() and further host-side writes through those corrupted structures during adapter-event delivery.\nA:H - Each duplicate REG_AEN leaks pinned guest pages, AIBV allocations, and summary bits without rollback when MPCIFC re-registration fails, enabling repeatable host memory exhaustion and kernel oops/panic via IRQ-time UAF dereferences."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:14.487Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70"
        },
        {
          "url": "https://git.kernel.org/stable/c/78d9648e7e960546d5b72504a0b0358cd8bb1e9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6be1ff49ba81f96a6fa55915e6d920be43ac57cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/6837f0ae85fd54cf64c8a0c7c530bba2fae0a207"
        },
        {
          "url": "https://git.kernel.org/stable/c/591952b63a9f976da7d49f719f36ec826ee2a575"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fa01be5a6149404adb82c0979a78f6347edd3ef"
        }
      ],
      "title": "KVM: s390: pci: Reject adapter interrupt forwarding if already enabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74515",
    "datePublished": "2026-08-15T12:27:35.567Z",
    "dateReserved": "2026-08-15T05:44:03.910Z",
    "dateUpdated": "2026-08-19T16:38:14.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74515",
      "date": "2026-09-11",
      "epss": "0.00129",
      "percentile": "0.02891"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T15:02:19.000Z",
      "cve": "CVE-2026-74515",
      "id": "msrc_CVE-2026-74515",
      "initial_release_date": "2026-08-23T15:02:19.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "KVM: s390: pci: Reject adapter interrupt forwarding if already enabled",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74515.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74515\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T13:17:56.630\",\"lastModified\":\"2026-08-19T17:21:08.263\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: s390: pci: Reject adapter interrupt forwarding if already enabled\\n\\nThe MPCIFC instruction doesn\u0027t allow registering adapter interrupts without\\nfirst unregistering. So reject any request to enable interrupt forwarding\\nif its already enabled for the zPCI device. This also fixes overwriting and\\nthus leaking resources when the ioctl is called multiple times for the same\\ndevice.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/s390/kvm/pci.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc\",\"lessThan\":\"642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc\",\"lessThan\":\"78d9648e7e960546d5b72504a0b0358cd8bb1e9d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc\",\"lessThan\":\"6be1ff49ba81f96a6fa55915e6d920be43ac57cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc\",\"lessThan\":\"6837f0ae85fd54cf64c8a0c7c530bba2fae0a207\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc\",\"lessThan\":\"591952b63a9f976da7d49f719f36ec826ee2a575\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc\",\"lessThan\":\"8fa01be5a6149404adb82c0979a78f6347edd3ef\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/s390/kvm/pci.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/591952b63a9f976da7d49f719f36ec826ee2a575\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6837f0ae85fd54cf64c8a0c7c530bba2fae0a207\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6be1ff49ba81f96a6fa55915e6d920be43ac57cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/78d9648e7e960546d5b72504a0b0358cd8bb1e9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8fa01be5a6149404adb82c0979a78f6347edd3ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-21T09:28:37+00:00",
      "cve": "CVE-2026-74515",
      "id": "CVE-2026-74515",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74515.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-18T00:07:40Z",
      "cve": "CVE-2026-74515",
      "id": "CVE-2026-74515",
      "initial_release_date": "2026-08-15T23:51:12Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74515",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74515.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.