CVE-2026-80891

KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

State: Published
Severity: Not scored
Published: Sep 4, 2026
Updated: Sep 4, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

The AIBV holds one bit per MSI-X vector for a given function. The size of the bit vector is derived from the NOI and the AIBVO. If the size of the AIBV exceeds a single page boundary, then reject the request as we cannot safely pin the guest AIBV.

Similarly reject the request if the AISB address is not 8-byte aligned as the architecture requires doubleword alignment for the summary bit address. Since the AISBO can address up to 64 bits, the size of the AISB can only be 8 bytes for the function. This also ensures the AISB doesn't exceed a single page boundary.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc to before 3a1c64220ede4ac9ef9a3e76f008ff60a34f4c48Affected 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc to before f00ef8efd41440129ccd88f4a1ebebf8d61d297fAffected 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc to before 15df7700dd99f8a37f5c6ed2dcf1e33009cdba47Affected 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc to before b878ba7e28144c9a857bc847d31f3c45413450acAffected 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc to before fbfe683f8b1ae7e40b56bdd6daf5bd671bc3a528Affected 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc to before 868d32ac72cba21c5c6d8a66a814b7c25a3a5c01Affected
LinuxLinux	6.0Affected before 6.0Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc to before 3a1c64220ede4ac9ef9a3e76f008ff60a34f4c48Affected
3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc to before f00ef8efd41440129ccd88f4a1ebebf8d61d297fAffected
3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc to before 15df7700dd99f8a37f5c6ed2dcf1e33009cdba47Affected
3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc to before b878ba7e28144c9a857bc847d31f3c45413450acAffected
3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc to before fbfe683f8b1ae7e40b56bdd6daf5bd671bc3a528Affected
3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc to before 868d32ac72cba21c5c6d8a66a814b7c25a3a5c01Affected

LinuxLinux

6.0Affected
before 6.0Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.