Executive brief
The Linux kernel's KVM hypervisor on IBM s390 systems contains a bug in PCI device interrupt initialization that can cause a crash when memory allocation fails. When a hypervisor attempts to set up interrupt forwarding for a PCI device and an internal allocation fails, the code does not properly handle the error condition, leading to a NULL pointer dereference that crashes the hypervisor and disrupts all virtual machines running on the host.
Technical details
The vulnerability is a NULL pointer dereference bug in arch/s390/kvm/pci.c within the kvm_s390_pci_aif_enable() function. The airq_iv_create() function can return NULL on allocation failure, but the return value was never checked. If allocation fails, zdev->aibv remains NULL and is subsequently dereferenced in kvm_zpci_set_airq(), causing a kernel panic. The fix adds a NULL check after airq_iv_create() and properly unwinds resource allocations (freeing AISB bit and zdev->aisb) before returning -ENOMEM. This is a memory handling issue triggered during PCI device interrupt setup, requiring no special attacker privileges but occurring only when the system is under memory pressure or resource exhaustion.
Affected products
- Linux Linux kernel Affects s390 KVM subsystem; patched in commits 8bf09b9b7d32 (upstream) and 0a95abe964400 (stable)
Timeline
- 2026-08-28: disclosed: CVE-2026-80684 published
- 2026-07-24: patched: Fix committed upstream as 8bf09b9b7d32
- 2026-08-09: patched: Fix backported to stable trees as 0a95abe964400