CVE-2026-80891: KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
The AIBV holds one bit per MSI-X vector for a given function. The size of the bit vector is derived from the NOI and the AIBVO. If the size of the AIBV exceeds a single page boundary, then reject the request as we cannot safely pin the guest AIBV.
Similarly reject the request if the AISB address is not 8-byte aligned as the architecture requires doubleword alignment for the summary bit address. Since the AISBO can address up to 64 bits, the size of the AISB can only be 8 bytes for the function. This also ensures the AISB doesn't exceed a single page boundary.
Affected Software
Event History
Frequently Asked Questions
What configurations are affected?
The issue applies to KVM on the s390 architecture when handling PCI interrupt structures for guest MSI-X functions. It concerns guest-provided AIBV or AISB addresses that do not meet the required size, page-boundary, or alignment constraints.
What input must an attacker control to trigger the vulnerable path?
An attacker would need control over guest PCI interrupt configuration values, specifically values affecting the AIBV size and location or the AISB address. Problematic inputs include an AIBV spanning more than one page or an AISB address that is not 8-byte aligned.
What validation does the fix add?
The fix rejects AIBV requests when the bit vector would cross a single page boundary. It also rejects AISB addresses that are not 8-byte aligned; because the AISB is limited to 8 bytes, this validation also prevents it from crossing a page boundary.