CVE-2026-80921

Received Received - Intake

KVM: s390 vsie Crypto Access Bits Stale Data Issue

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-80921

EUVD

EUVD-2026-75098

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel related to KVM (Kernel-based Virtual Machine) on s390 architecture. It involves improper handling of crypto access bits when shadowing format0 APCB (Access Protection Control Block) in a virtual machine. Specifically, bits 64 to 255 in the crypto control block are not zeroed out, potentially allowing a nested guest VM to access a device that is no longer available to it.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation on s390 architecture. Detection requires checking kernel version and KVM configuration. Use uname -a to verify kernel version and grep for KVM modules. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow a malicious nested guest VM to gain unauthorized access to cryptographic resources or devices that should no longer be accessible. This may lead to data leaks, unauthorized operations, or potential privilege escalation within the virtualized environment.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially allowing unauthorized access to sensitive data or cryptographic resources. Unauthorized access risks violating data protection requirements, leading to legal and regulatory penalties.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the KVM s390 vsie crypto access bits issue. Monitor vendor advisories for kernel updates specific to your distribution.

Hi! I’m here to help you understand CVE-2026-80921. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70