Executive brief
The Linux kernel's KVM hypervisor on IBM System z architecture lacked proper validation of interrupt configuration parameters before pinning guest memory pages. An attacker with access to configure PCI device interrupt forwarding could specify malformed parameters that cause the kernel to pin incorrect memory regions, potentially exposing sensitive guest data or causing denial of service.
Technical details
The vulnerability exists in the KVM s390 PCI interrupt forwarding code (arch/s390/kvm/pci.c), specifically in the kvm_s390_pci_aif_enable() function. The code pinned guest memory pages for interrupt bit vectors (AIBV) and interrupt summary bits (AISB) without validating that the memory regions fit within single page boundaries or met architectural alignment requirements. An attacker with capability to configure PCIe device interrupt parameters (such as a privileged guest VM or host process) could specify AIBV/AISB addresses that exceed page boundaries or violate doubleword alignment constraints, leading to memory pinning errors or data exposure. The fix adds validation checks to reject oversized AIBV regions and enforce 8-byte alignment on AISB addresses before pinning any pages.
Affected products
- Linux Linux kernel All versions with s390 KVM PCI support (introduced in commit 3c5a1b6f0a18, patched 2026-07-23)
Timeline
- 2026-09-04: disclosed: CVE-2026-80891 published
- 2026-07-23: patched: Patch developed by Farhan Ali
- 2026-08-09: advisory: Fix merged into stable kernel trees