CVE-2026-80921

What it actually does

The vulnerability fails to clear stale bits 64-255 in the APCB when shadowing format-0 crypto access controls into the VSIE page, leaving a nested guest with residual permissions to cryptographic devices that have been revoked from its parent.

Why it matters to the business

In s390 virtualized environments an attacker-controlled nested guest may retain unauthorized access to cryptographic hardware, increasing the risk of data exposure, integrity violations, or lateral movement within the host's crypto resources.

How an attack unfolds

An attacker with a compromised or malicious nested guest configures a format-0 APCB, triggers the shadowing path in the VSIE handler, and then uses the retained stale bits to issue crypto operations against devices that the hypervisor has since removed from the guest's access mask.

How to fix it

Apply the upstream kernel commit that zeros the remaining APCB bits during format-0 shadowing; rebuild and deploy the patched KVM module on all s390 hosts running nested virtualization.

How to confirm the fix worked

Confirm the fix by inspecting the VSIE crypto shadowing code path to ensure bits 64-255 are explicitly cleared; run regression tests that revoke crypto devices and verify the nested guest can no longer access them after the change.

Typical attack path

1. Obtain code execution inside a nested s390 KVM guest
2. Prepare a format-0 APCB containing desired crypto access bits
3. Cause the L1 hypervisor to perform VSIE shadowing of the APCB
4. Observe that bits 64-255 retain prior values instead of being zeroed
5. Issue crypto requests using the stale permissions to reach revoked devices

How to detect it

Review hypervisor logs for unexpected crypto device access attempts from nested guests after device revocation events; correlate with VSIE page allocations and APCB shadowing operations in kernel traces.

What your security team should do

• Prioritize patching s390 KVM hosts that enable nested virtualization
• Audit all s390 systems for nested-guest workloads and restrict crypto device passthrough where possible
• Monitor upstream stable branches for the backported fix and schedule kernel updates within the normal change window