CVE-2026-80684

A flaw was found in the KVM (Kernel-based Virtual Machine) subsystem for s390 PCI devices in the Linux kernel. This vulnerability occurs when the airq_iv_create() function fails to allocate a resource, returning a NULL value that is not properly checked. An attacker, potentially a malicious guest user, could exploit this unchecked return value, leading to a NULL pointer dereference in kvm_zpci_set_airq(). This could result in a system crash, causing a Denial of Service (DoS).

A moderate NULL pointer dereference flaw was found in the Linux kernel's KVM support for s390 PCI (zPCI) devices. When KVM interrupt forwarding is set up for a zPCI device, airq_iv_create() can return NULL if the AIBV allocation fails, and this return value was never checked, leaving zdev->aibv NULL and causing a NULL dereference in kvm_zpci_set_airq(). A malicious local guest user on an s390 KVM host with a zPCI device assigned through passthrough or interrupt forwarding could trigger this path — which additionally requires an allocation failure during AIBV setup — and crash the host kernel, resulting in denial of service with no confidentiality or integrity impact. Red Hat rated this flaw Moderate (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); the Critical 9.3 score in the upstream CVE record is not supported by the technical evidence, which shows only a local, availability-only impact without scope change. The vulnerable code is present in the kernel and kernel-rt packages of Red Hat Enterprise Linux 8.8 and 8.10 update streams, RHEL 9.2, 9.4, 9.6, 9.8, 9.9 and 9.10 streams, and RHEL 10.0, 10.2, 10.3 and 10.4 streams, as well as Red Hat In-Vehicle OS 2.0 and 2.1; RHEL 6, 7, 8.4 and 8.6 are not affected because the vulnerable code is not present in those streams. Fixes for the affected streams are currently deferred because this is a moderate denial-of-service condition whose practical trigger requires an unlikely allocation failure on s390 KVM hosts using zPCI interrupt forwarding; the residual risk is limited to a host kernel crash on such systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.