Cloudanix VulnDB

CVE-2026-80684

Critical · 9.3

CVSS

9.3

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel used on IBM mainframes could let a local program crash the entire system when certain hardware devices are being set up.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability is a missing NULL check after airq_iv_create() in the s390 KVM PCI path; on allocation failure zdev->aibv remains NULL and is later dereferenced inside kvm_zpci_set_airq(), producing a kernel NULL-pointer dereference.

Why it matters to the business

Unpatched s390 KVM hosts may suffer kernel crashes or denial-of-service when PCI passthrough devices are attached under memory pressure, affecting virtual-machine availability on enterprise mainframe systems.

How an attack unfolds

An attacker with local access triggers the vulnerable allocation path during PCI device attachment so that airq_iv_create() fails, leaving zdev->aibv NULL; the subsequent call to kvm_zpci_set_airq() then dereferences the pointer and crashes the kernel.

How to fix it

Apply the upstream fix that adds the missing NULL check after airq_iv_create() and releases the previously allocated AISB bit and zdev->aisb on failure; install a Linux kernel containing the resolution for this s390 KVM PCI bug.

How to confirm the fix worked

Inspect the s390 PCI KVM code for the added return-value check on airq_iv_create(); reproduce allocation-failure conditions in a test environment and confirm no NULL dereference occurs.

Typical attack path

  1. Attach a PCI device to a KVM guest on s390
  2. Induce memory pressure so airq_iv_create() returns NULL
  3. Reach kvm_zpci_set_airq() which dereferences the unset aibv pointer
  4. Trigger kernel panic or memory corruption

How to detect it

Search kernel logs and crash dumps for NULL pointer dereference stack traces containing kvm_zpci_set_airq, airq_iv_create, or s390 PCI interrupt-vector allocation functions.

  • kvm_zpci_set_airq
  • airq_iv_create

What your security team should do

  • Patch s390 KVM hosts immediately
  • Restrict PCI passthrough on unpatched systems
  • Monitor kernel logs for oops in kvm_zpci_set_airq and airq_iv paths

The record

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when dereferenced in kvm_zpci_set_airq(). Add a NULL check and free the previously allocated AISB bit and zdev->aisb on failure.

Affected packages

Ecosystem Package Introduced Fixed