HIGH Introduced in 4.20
kvm CryptoBits Leak
CVE-2026-80921
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI5.2MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.
02KernelScan AI Analysis
Risk summary
A nested guest running on an s390x KVM host with nested virtualization enabled can retain access to cryptographic devices that have been revoked or were never assigned, due to stale bits in the shadowed crypto access control block. This allows unauthorized use of host crypto hardware by the nested guest. The issue affects any s390x KVM deployment using nested virtualization (vsie) with format-0 crypto control blocks.
Vulnerability analysis
When an s390x KVM host sets up crypto access controls for a nested guest using a smaller-format crypto control block, it only properly filters the lower bits of each access bitmap, leaving the remaining bits with stale values from the shadow page. These stale bits can grant the nested guest access to cryptographic devices that should no longer be available to it. The fix zeroes the entire shadow control block before copying in only the valid bits, so no stale permissions persist. The vulnerability is reachable from a nested guest on an s390x KVM host with nested virtualization enabled, and the impact is unauthorized access to host cryptographic devices.
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.20 | 5.10.269 | d110b3297f11 |
| 5.15 | 4.20 | 5.15.220 | 59d51550b5cb |
| 6.1 | 4.20 | 6.1.187 | f6079dca67ec |
| 6.12 | 4.20 | 6.12.108 | 7d23489f5110 |
| 6.18 | 4.20 | 6.18.49 | 935eeba27601 |
| 6.6 | 4.20 | 6.6.156 | 087c19cc60a8 |
| 7.1 | 4.20 | 7.1.13 | d4bcd2df6d0d |
| 7.2 | 4.20 | 7.2.3 | 29b4f7bc2991 |
| mainline | 4.20 | 7.3-rc1 | 34d5b5b646c9 |