Bug 2528785 (CVE-2026-80891) - CVE-2026-80891 kernel: KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
Summary: CVE-2026-80891 kernel: KVM: s390: pci: Validate AIBV and AISB before pinning ...
Keywords:
Status: NEW
Alias: CVE-2026-80891
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-04 17:33 UTC by OSIDB Bzimport
Modified: 2026-10-24 02:04 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-04 17:33:12 UTC
In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

The AIBV holds one bit per MSI-X vector for a given function. The size of
the bit vector is derived from the NOI and the AIBVO. If the size of the
AIBV exceeds a single page boundary, then reject the request as we cannot
safely pin the guest AIBV.

Similarly reject the request if the AISB address is not 8-byte aligned as
the architecture requires doubleword alignment for the summary bit address.
Since the AISBO can address up to 64 bits, the size of the AISB can only be
8 bytes for the function. This also ensures the AISB doesn't exceed a
single page boundary.


Note You need to log in before you can comment on or make changes to this bug.