Riskcovery

CVE-2026-80921

KVM: s390: vsie: zero stale crypto bits

State
Published
Severity
8.8 High
Published
Sep 9, 2026
Updated
Oct 19, 2026
Reserved
Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: vsie: zero stale crypto bits

When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 6b79de4b056e5a2febc0c61233d8f0ad7868e49c to before d110b3297f11ef227098b8a82ade2d5f123b7d2fAffected
  • 6b79de4b056e5a2febc0c61233d8f0ad7868e49c to before 59d51550b5cb916bda037673a721a404b3b47a0dAffected
  • 6b79de4b056e5a2febc0c61233d8f0ad7868e49c to before f6079dca67eccb5eabef9f72437948c66dc5131fAffected
  • 6b79de4b056e5a2febc0c61233d8f0ad7868e49c to before 087c19cc60a8caa1a08e1e434c8be2caf6c27733Affected
  • 6b79de4b056e5a2febc0c61233d8f0ad7868e49c to before 7d23489f51109e3ebba5b5db8c5f0185af7b7fdfAffected
  • 6b79de4b056e5a2febc0c61233d8f0ad7868e49c to before 935eeba276012916c76243e5cbb843efd8fdb75dAffected
  • 6b79de4b056e5a2febc0c61233d8f0ad7868e49c to before d4bcd2df6d0d2af916b4fe1a533958778ea7c45bAffected
  • 6b79de4b056e5a2febc0c61233d8f0ad7868e49c to before 29b4f7bc2991313bd3e6f6fb8fdf1b173f086dd6Affected
  • 6b79de4b056e5a2febc0c61233d8f0ad7868e49c to before 34d5b5b646c91cfb9338d7a12c955a70ffb8c66bAffected
LinuxLinux
  • 4.20Affected
  • before 4.20Not affected
  • 5.10.269 through 5.10.*Not affected
  • 5.15.220 through 5.15.*Not affected
  • 6.1.187 through 6.1.*Not affected
  • 6.6.156 through 6.6.*Not affected
  • 6.12.108 through 6.12.*Not affected
  • 6.18.49 through 6.18.*Not affected
  • 7.1.13 through 7.1.*Not affected
  • 7.2.3 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.