CVE-2026-80891

What it actually does

Missing validation of guest-supplied AIBV size and AISB alignment allows attempts to pin guest memory regions that cross page boundaries or violate required doubleword alignment during s390 PCI interrupt vector setup in KVM.

Why it matters to the business

Hypervisor instability or memory-safety issues on s390 systems running virtualized workloads with PCI passthrough, increasing operational risk and potential downtime until patched kernels are deployed.

How an attack unfolds

A malicious guest configures a PCI function with an oversized AIBV or misaligned AISB; the hypervisor accepts the values without size or alignment checks and proceeds to pin the guest pages, enabling unsafe memory operations that an attacker inside the guest can trigger.

How to fix it

Update to a Linux kernel containing the validation checks for AIBV size and AISB alignment before guest page pinning; rebuild and reboot s390 hosts running KVM with PCI devices.

How to confirm the fix worked

Confirm the running kernel contains the commit that adds explicit AIBV size and AISB alignment checks; test by attempting PCI function registration with oversized or misaligned vectors and verify rejection occurs.

Typical attack path

1. Compromise or control a guest VM with PCI device assignment
2. Craft PCI configuration supplying AIBV exceeding one page or non-8-byte-aligned AISB
3. Trigger KVM s390 PCI interrupt setup path
4. Observe or exploit resulting page pinning behavior inside the host

How to detect it

Review kernel logs on s390 hosts for PCI interrupt setup failures or page pinning warnings; examine guest PCI configuration attempts that previously would have been accepted without size or alignment validation.

What your security team should do

• Prioritize kernel updates on all s390 KVM hosts that expose PCI passthrough
• Audit guest configurations for PCI devices and restrict untrusted guests where possible
• Monitor for future s390 KVM patches addressing interrupt vector handling