Junglewise Threat Intelligence

CVE-2026-80684: Linux kernel KVM s390 NULL dereference in PCI interrupt allocation

CVE-2026-80684 · Severity: critical · CVSS 9.3 · Published 2026-08-28

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's KVM hypervisor on IBM s390 systems contains a bug in PCI device interrupt initialization that can cause a crash when memory allocation fails. When a hypervisor attempts to set up interrupt forwarding for a PCI device and an internal allocation fails, the code does not properly handle the error condition, leading to a NULL pointer dereference that crashes the hypervisor and disrupts all virtual machines running on the host.

Technical details

The vulnerability is a NULL pointer dereference bug in arch/s390/kvm/pci.c within the kvm_s390_pci_aif_enable() function. The airq_iv_create() function can return NULL on allocation failure, but the return value was never checked. If allocation fails, zdev->aibv remains NULL and is subsequently dereferenced in kvm_zpci_set_airq(), causing a kernel panic. The fix adds a NULL check after airq_iv_create() and properly unwinds resource allocations (freeing AISB bit and zdev->aisb) before returning -ENOMEM. This is a memory handling issue triggered during PCI device interrupt setup, requiring no special attacker privileges but occurring only when the system is under memory pressure or resource exhaustion.

Affected products

  • Linux Linux kernel Affects s390 KVM subsystem; patched in commits 8bf09b9b7d32 (upstream) and 0a95abe964400 (stable)

Timeline

  • 2026-08-28: disclosed: CVE-2026-80684 published
  • 2026-07-24: patched: Fix committed upstream as 8bf09b9b7d32
  • 2026-08-09: patched: Fix backported to stable trees as 0a95abe964400

References

Related threats