Executive brief
A vulnerability was identified in the Linux kernel's virtualization component (KVM) for s390 architectures. It involves a technical error in how the system calculates memory addresses for PCI device tables, which can lead to the system accessing memory outside of intended boundaries. This could potentially result in system instability or unauthorized access to kernel memory.
Technical details
An out-of-bounds access vulnerability exists in the Linux kernel's KVM implementation for s390 architectures within the PCI interrupt handling logic. The functions kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() incorrectly performed manual multiplication of an index by the size of 'struct zpci_gaite' when the base pointer was already of that type. This resulted in 'double-scaling' of the pointer offset, causing the kernel to access memory significantly beyond the intended table bounds when the index (aisb) was 32 or greater. This flaw could lead to kernel memory corruption or information leakage. The issue has been resolved by removing the redundant size multiplication in the pointer arithmetic.
Affected products
- Linux Linux Kernel 6.0 to 7.1
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://git.kernel.org/stable/c/11b8ff5b930b351dd1f6f088dce0beb027ac92d0
- https://git.kernel.org/stable/c/16d990a15491cf76cd6eef0846e1b4100e63261a
- https://git.kernel.org/stable/c/31a9d9f9942885aae356a1a57c79e82c5b5b0828
- https://git.kernel.org/stable/c/a99a25db131ece5e6c0f7632da606de631efe4f2
- https://git.kernel.org/stable/c/b22a2da8792a7bfe743c1a922e77fa499ddedbe8
- https://git.kernel.org/stable/c/e7216651b94e92e5433fb2f54b77864642b4ea48