CVE-2026-52968

KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

State: Published
Severity: 8.8 High
Published: Jun 24, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() index the GAIT by manually multiplying the index with sizeof(struct zpci_gaite).

Since aift->gait is already a struct zpci_gaite pointer, this double-scales the offset, accessing element aisb*16 instead of aisb.

This causes out-of-bounds accesses when aisb >= 32 (with ZPCI_NR_DEVICES=512)

Fix by removing the erroneous sizeof multiplication.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	73f91b004321f2510fa79e66035dbbf1870fcf56 to before 31a9d9f9942885aae356a1a57c79e82c5b5b0828Affected 73f91b004321f2510fa79e66035dbbf1870fcf56 to before a99a25db131ece5e6c0f7632da606de631efe4f2Affected 73f91b004321f2510fa79e66035dbbf1870fcf56 to before 11b8ff5b930b351dd1f6f088dce0beb027ac92d0Affected 73f91b004321f2510fa79e66035dbbf1870fcf56 to before b22a2da8792a7bfe743c1a922e77fa499ddedbe8Affected 73f91b004321f2510fa79e66035dbbf1870fcf56 to before e7216651b94e92e5433fb2f54b77864642b4ea48Affected 73f91b004321f2510fa79e66035dbbf1870fcf56 to before 16d990a15491cf76cd6eef0846e1b4100e63261aAffected
LinuxLinux	6.0Affected before 6.0Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

73f91b004321f2510fa79e66035dbbf1870fcf56 to before 31a9d9f9942885aae356a1a57c79e82c5b5b0828Affected
73f91b004321f2510fa79e66035dbbf1870fcf56 to before a99a25db131ece5e6c0f7632da606de631efe4f2Affected
73f91b004321f2510fa79e66035dbbf1870fcf56 to before 11b8ff5b930b351dd1f6f088dce0beb027ac92d0Affected
73f91b004321f2510fa79e66035dbbf1870fcf56 to before b22a2da8792a7bfe743c1a922e77fa499ddedbe8Affected
73f91b004321f2510fa79e66035dbbf1870fcf56 to before e7216651b94e92e5433fb2f54b77864642b4ea48Affected
73f91b004321f2510fa79e66035dbbf1870fcf56 to before 16d990a15491cf76cd6eef0846e1b4100e63261aAffected

LinuxLinux

6.0Affected
before 6.0Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.