CVE-2026-80891

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Validate AIBV and AISB before pinning guest pages The AIBV holds one bit per MSI-X vector for a given function. The size of the bit vector is derived from the NOI and the AIBVO. If the size of the AIBV exceeds a single page boundary, then reject the request as we cannot safely pin the guest AIBV. Similarly reject the request if the AISB address is not 8-byte aligned as the architecture requires doubleword alignment for the summary bit address. Since the AISBO can address up to 64 bits, the size of the AISB can only be 8 bytes for the function. This also ensures the AISB doesn't exceed a single page boundary.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/15df7700dd99f8a37f5c6ed2dcf1e33009cdba47
https://git.kernel.org/stable/c/3a1c64220ede4ac9ef9a3e76f008ff60a34f4c48
https://git.kernel.org/stable/c/868d32ac72cba21c5c6d8a66a814b7c25a3a5c01
https://git.kernel.org/stable/c/b878ba7e28144c9a857bc847d31f3c45413450ac
https://git.kernel.org/stable/c/f00ef8efd41440129ccd88f4a1ebebf8d61d297f
https://git.kernel.org/stable/c/fbfe683f8b1ae7e40b56bdd6daf5bd671bc3a528

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-04 18:17

Updated : 2026-09-04 18:17

NVD link : CVE-2026-80891

Mitre link : CVE-2026-80891

CVE.ORG link : CVE-2026-80891

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-80891", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "3a1c64220ede4ac9ef9a3e76f008ff60a34f4c48", "versionType": "git"}, {"status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "f00ef8efd41440129ccd88f4a1ebebf8d61d297f", "versionType": "git"}, {"status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "15df7700dd99f8a37f5c6ed2dcf1e33009cdba47", "versionType": "git"}, {"status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "b878ba7e28144c9a857bc847d31f3c45413450ac", "versionType": "git"}, {"status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "fbfe683f8b1ae7e40b56bdd6daf5bd671bc3a528", "versionType": "git"}, {"status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "868d32ac72cba21c5c6d8a66a814b7c25a3a5c01", "versionType": "git"}], "programFiles": ["arch/s390/kvm/pci.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"status": "unaffected", "version": "0", "lessThan": "6.0", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.151", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.103", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/s390/kvm/pci.c"], "defaultStatus": "affected"}]}], "published": "2026-09-04T18:17:57.217", "references": [{"url": "https://git.kernel.org/stable/c/15df7700dd99f8a37f5c6ed2dcf1e33009cdba47", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3a1c64220ede4ac9ef9a3e76f008ff60a34f4c48", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/868d32ac72cba21c5c6d8a66a814b7c25a3a5c01", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b878ba7e28144c9a857bc847d31f3c45413450ac", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f00ef8efd41440129ccd88f4a1ebebf8d61d297f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fbfe683f8b1ae7e40b56bdd6daf5bd671bc3a528", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Validate AIBV and AISB before pinning guest pages\n\nThe AIBV holds one bit per MSI-X vector for a given function. The size of\nthe bit vector is derived from the NOI and the AIBVO. If the size of the\nAIBV exceeds a single page boundary, then reject the request as we cannot\nsafely pin the guest AIBV.\n\nSimilarly reject the request if the AISB address is not 8-byte aligned as\nthe architecture requires doubleword alignment for the summary bit address.\nSince the AISBO can address up to 64 bits, the size of the AISB can only be\n8 bytes for the function. This also ensures the AISB doesn't exceed a\nsingle page boundary."}], "lastModified": "2026-09-04T18:17:57.217", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}