CVE-2026-52968: KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic
kvms390pciaifenable(), kvms390pciaifdisable(), and aenhostforward() index the GAIT by manually multiplying the index with sizeof(struct zpcigaite).
Since aift->gait is already a struct zpcigaite pointer, this double-scales the offset, accessing element aisb16 instead of aisb.
This causes out-of-bounds accesses when aisb >= 32 (with ZPCINRDEVICES=512)
Fix by removing the erroneous sizeof multiplication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Compensating control
Apply the Linux kernel fix for “KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic” by removing the erroneous sizeof multiplication that double-scales the GAIT table offset (so the GAIT element index is not accessed as aisb*16 instead of aisb), which prevents out-of-bounds accesses when aisb >= 32 (e.g., with ZPCI_NR_DEVICES=512).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52968?
CVE-2026-52968 has a risk score of 40, indicating a significant vulnerability.
How do I fix CVE-2026-52968?
To fix CVE-2026-52968, ensure that you update your Linux kernel to a version where the vulnerability has been patched.
What components are affected by CVE-2026-52968?
CVE-2026-52968 affects the KVM (Kernel-based Virtual Machine) component within the Linux kernel on s390 architecture.
What are the potential consequences of exploiting CVE-2026-52968?
Exploitation of CVE-2026-52968 could lead to improper indexing in the GAIT table, potentially leading to unexpected behavior in KVM operations.
When was CVE-2026-52968 published?
CVE-2026-52968 was published on June 24, 2026.