In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

The AIBV holds one bit per MSI-X vector for a given function. The size of
the bit vector is derived from the NOI and the AIBVO. If the size of the
AIBV exceeds a single page boundary, then reject the request as we cannot
safely pin the guest AIBV.

Similarly reject the request if the AISB address is not 8-byte aligned as
the architecture requires doubleword alignment for the summary bit address.
Since the AISBO can address up to 64 bits, the size of the AISB can only be
8 bytes for the function. This also ensures the AISB doesn't exceed a
single page boundary.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/15df7700dd99f8a37f5c6ed2dcf1e33009cdba47 cve-icon cve-icon
https://git.kernel.org/stable/c/3a1c64220ede4ac9ef9a3e76f008ff60a34f4c48 cve-icon cve-icon
https://git.kernel.org/stable/c/868d32ac72cba21c5c6d8a66a814b7c25a3a5c01 cve-icon cve-icon
https://git.kernel.org/stable/c/b878ba7e28144c9a857bc847d31f3c45413450ac cve-icon cve-icon
https://git.kernel.org/stable/c/f00ef8efd41440129ccd88f4a1ebebf8d61d297f cve-icon cve-icon
https://git.kernel.org/stable/c/fbfe683f8b1ae7e40b56bdd6daf5bd671bc3a528 cve-icon cve-icon
History

Fri, 04 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-680

Fri, 04 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Validate AIBV and AISB before pinning guest pages The AIBV holds one bit per MSI-X vector for a given function. The size of the bit vector is derived from the NOI and the AIBVO. If the size of the AIBV exceeds a single page boundary, then reject the request as we cannot safely pin the guest AIBV. Similarly reject the request if the AISB address is not 8-byte aligned as the architecture requires doubleword alignment for the summary bit address. Since the AISBO can address up to 64 bits, the size of the AISB can only be 8 bytes for the function. This also ensures the AISB doesn't exceed a single page boundary.
Title KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-04T17:11:07.555Z

Reserved: 2026-08-26T14:34:25.799Z

Link: CVE-2026-80891

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T18:17:57.217

Modified: 2026-09-04T18:17:57.217

Link: CVE-2026-80891

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T21:15:05Z

Weaknesses