CVE-2026-80891

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) s390 PCI component. This vulnerability arises from insufficient validation of the Adapter Interrupt Block Vector (AIBV) and Adapter Interrupt Summary Block (AISB) parameters before pinning guest pages. An attacker, by providing malformed AIBV or AISB values, could potentially cause the system to perform unsafe memory operations, leading to system instability or a denial of service.

KVM s390 PCI interrupt forwarding accepted guest supplied AIBV and AISB parameters without fully validating the AIBV page boundary and AISB doubleword alignment. A malicious guest with access to the affected s390 KVM PCI configuration could provide an AIBV whose computed bit vector crosses a page boundary even though only one guest page is pinned, or provide a misaligned AISB address. This can create unsafe host handling of guest memory used for interrupt forwarding and may lead to host denial of service or memory safety impact. For the CVSS the PR:L is used because exploitation requires control of a guest or local KVM process rather than full host administrative privileges. The issue is not directly network reachable and is a guest to host virtualization boundary risk. Impact is at least host denial of service and in the paranoid case may include confidentiality and integrity impact due to possible memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.