Executive brief
The Linux kernel's KVM (virtualization layer) on IBM s390 systems has a flaw in virtual system-mode instruction execution (vsie) that fails to clear stale cryptographic access bits when shadowing crypto control blocks. A nested virtual guest could exploit this to access cryptographic devices that are no longer authorized, potentially leading to unauthorized cryptographic operations or information disclosure.
Technical details
This is a privilege escalation / information disclosure vulnerability in the KVM s390 vsie implementation (arch/s390/kvm/vsie.c). When setting up crypto access control bits (apcb) for a format-0 crypto control block (crycb), bits 64–255 were not being zeroed out and retained stale values from the vsie page. An attacker running as a nested guest could leverage this to gain unauthorized access to cryptographic accelerator devices that should have been revoked. The fix adds a memset() call to zero out the entire apcb structure before selectively copying permitted bits, preventing information leakage and unauthorized device access. No authentication or special preconditions are required—any nested guest can trigger this. Patches have been merged into multiple stable kernel branches (5.10.y through 7.2.y and later).
Affected products
- Linux Linux kernel Multiple stable branches (5.10.y, 5.15.y, 5.19.y, 6.1.y, 6.6.y, 6.9.y, 7.0.y, 7.1.y, 7.2.y and others) prior to patched commits 087c19cc60a8 and 29b4f7bc2991
Timeline
- 2026-09-09: disclosed
- 2026-09-02: patched: Patches merged into stable kernel branches