CVE-2026-80684

Received Received - Intake

KVM NULL Dereference in Linux Kernel PCI Subsystem

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when dereferenced in kvm_zpci_set_airq(). Add a NULL check and free the previously allocated AISB bit and zdev->aisb on failure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80684

EUVD

EUVD-2026-67560

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) module for s390 (IBM Z) systems. It occurs when the airq_iv_create() function fails to allocate memory for an AIBV (Adapter Interrupt Bit Vector) and returns NULL without proper error handling. The code then attempts to use this NULL pointer, leading to a crash when dereferenced in kvm_zpci_set_airq().

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM s390 PCI implementation and may not have direct network detection methods. Check kernel logs for NULL pointer dereference errors related to kvm_zpci_set_airq or airq_iv_create failures. Use commands like dmesg | grep -i 'kvm\|aibv\|airq' or journalctl -k | grep -i 'kvm\|aibv\|airq' to inspect system logs for related errors.

Impact Analysis

If exploited, this vulnerability could cause a denial of service (DoS) by crashing the host system running the vulnerable Linux kernel. It specifically affects KVM virtualization on s390 systems, potentially disrupting virtual machines and services relying on PCI passthrough functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a NULL dereference issue in the Linux kernel's KVM s390 PCI module, which could lead to system crashes or instability but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If immediate patching is not possible, consider disabling KVM s390 PCI functionality if not in use. Monitor kernel security advisories for updates and follow vendor-specific mitigation guidance.

Hi! I’m here to help you understand CVE-2026-80684. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70