CRITICAL Introduced in 6.0
kvm s390pci AibvAlloc Deref
CVE-2026-80684
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when dereferenced in kvm_zpci_set_airq(). Add a NULL check and free the previously allocated AISB bit and zdev->aisb on failure.
02KernelScan AI Analysis
Risk summary
A NULL pointer dereference occurs in the KVM s390 PCI interrupt forwarding code when an interrupt vector allocation fails but the return value is not checked. A local user with access to KVM on s390 can trigger a kernel panic, causing a denial of service.
Vulnerability analysis
When enabling adapter interrupt forwarding for a s390 PCI device, the kernel allocates an interrupt vector but does not check whether the allocation succeeded. If the allocation fails under memory pressure, the code continues with a NULL pointer that is later dereferenced when setting up the interrupt, leading to a kernel panic. The fix adds a NULL check after the allocation and, on failure, releases the previously allocated resources before returning an error. This path is reachable from a KVM ioctl on s390 systems configured for PCI interrupt forwarding and requires a local user with access to KVM device operations.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 6.0 | 6.1.183 | 96099486b639 |
| 6.12 | 6.0 | 6.12.103 | df947d85e164 |
| 6.18 | 6.0 | 6.18.44 | e137d082325b |
| 6.6 | 6.0 | 6.6.151 | 0a95abe96440 |
| 7.1 | 6.0 | 7.1.8 | d1a103dc9016 |
| mainline | 6.0 | 7.2 | 8bf09b9b7d32 |
| cip/6.1 | 6.0 | 6.1.187-cip60 | 96099486b639 |
| cip/6.1-rt | 6.0 | 6.1.189-cip61-rt32 | 96099486b639 |
| cip/6.12 | 6.0 | 6.12.104-cip30 | df947d85e164 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.104-cip30 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |