CVE-2026-80921: KVM: s390: vsie: zero stale crypto bits
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: vsie: zero stale crypto bits
When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
The issue applies to Linux kernel KVM on s390 systems using VSIE with nested guests. It concerns shadowing crypto access bits from a format0 APCB with crycb 0 or 1.
What could an attacker gain through exploitation?
A nested guest may retain access to a crypto device that is no longer available to it because bits 64 through 255 can remain stale in the VSIE page's APCB.
What condition triggers the stale access bits?
The condition occurs when crypto access bits are shadowed from a format0 APCB for crycb 0 or 1 and the remaining bit range is not cleared. The resolved change zeroes those remaining bits.
Does the available information indicate whether default KVM configurations are affected?
No. The provided information identifies the affected VSIE and APCB handling path but does not state whether it is enabled or reachable in a default configuration.