CVE-2026-52968 Overview
CVE-2026-52968 is an out-of-bounds memory access vulnerability in the Linux kernel's KVM subsystem for the IBM s390 architecture. The flaw resides in the PCI Adapter Interrupt Forwarding (AIF) code path, where the Guest Adapter Interruption Table (GAIT) is incorrectly indexed. Three functions, kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward(), manually multiply the index by sizeof(struct zpci_gaite) even though aift->gait is already typed as a struct zpci_gaite pointer. The resulting double-scaling causes the kernel to access element aisb*16 instead of aisb, triggering out-of-bounds reads and writes when aisb >= 32 with ZPCI_NR_DEVICES=512.
Critical Impact
Out-of-bounds GAIT access in KVM s390 PCI code can corrupt adjacent kernel memory, potentially leading to host instability, denial of service, or memory disclosure on s390x virtualization hosts.
Affected Products
- Linux kernel builds for the IBM s390x architecture with KVM and zPCI support enabled
- Hypervisor hosts using CONFIG_PCI and ZPCI_NR_DEVICES=512 configurations
- Stable Linux kernel branches prior to the commits referenced in the upstream fix series
Discovery Timeline
- 2026-06-24 - CVE-2026-52968 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52968
Vulnerability Analysis
The vulnerability is an out-of-bounds access [CWE-787/CWE-125] in the s390 KVM PCI Adapter Event Notification (AEN) path. The GAIT is an array of struct zpci_gaite entries used to forward PCI adapter interrupts to guest virtual machines. Three kernel functions index this array using pointer arithmetic that scales the offset twice. Because the C compiler already multiplies pointer arithmetic by the element size for typed pointers, the additional explicit multiplication by sizeof(struct zpci_gaite) produces an offset 16 times larger than intended.
The practical effect is that any access to gait[aisb] actually reads or writes memory at gait[aisb * 16]. When the Adapter Interrupt Source Bit (aisb) is 32 or larger, the computed address moves outside the allocated GAIT region. With ZPCI_NR_DEVICES=512, guest configurations can readily produce aisb values in this range during AIF enable, disable, or interrupt forwarding operations.
Root Cause
The root cause is incorrect pointer arithmetic. Developers treated aift->gait as a raw byte pointer and applied manual scaling, but the field is declared as struct zpci_gaite *. The fix removes the redundant sizeof() multiplication so that array indexing scales the offset exactly once.
Attack Vector
Exploitation requires the ability to drive the s390 PCI AEN code path with a controlled aisb value, typically through guest-initiated KVM operations that enable or disable adapter interrupt forwarding. A guest with permission to attach zPCI devices and trigger AIF configuration can induce out-of-bounds GAIT accesses on the host, potentially corrupting kernel data structures adjacent to the GAIT allocation or causing host kernel crashes.
No public proof-of-concept code is associated with this CVE. The vulnerability is documented in the upstream kernel commit series referenced below.
Detection Methods for CVE-2026-52968
Indicators of Compromise
- Unexpected kernel oops or panic messages on s390x KVM hosts referencing kvm_s390_pci_aif_enable, kvm_s390_pci_aif_disable, or aen_host_forward
- KASAN out-of-bounds reports against the gait allocation on kernels built with memory sanitizers enabled
- Guest VMs experiencing interrupt delivery failures correlated with host warnings in the s390 PCI subsystem
Detection Strategies
- Audit running kernel versions on s390x hypervisors and compare against the patched commit hashes 11b8ff5b930b, 16d990a15491, 31a9d9f9942, a99a25db131e, b22a2da8792a, and e7216651b94e
- Enable KASAN (CONFIG_KASAN) on test kernels to surface out-of-bounds GAIT accesses during regression testing
- Review host dmesg output for WARN or BUG traces originating in arch/s390/kvm/pci.c
Monitoring Recommendations
- Centralize kernel logs from s390x KVM hosts and alert on stack traces involving the s390 PCI AIF functions
- Track guest lifecycle events that perform zPCI attach or AIF configuration so anomalous repetition can be correlated with host instability
- Monitor host uptime and unplanned reboots on s390x virtualization fleets as a proxy for memory corruption symptoms
How to Mitigate CVE-2026-52968
Immediate Actions Required
- Update affected s390x kernels to a stable release that includes the GAIT indexing fix from the linked upstream commits
- Inventory all IBM Z and LinuxONE hosts running KVM with zPCI passthrough and prioritize them for patching
- Restrict zPCI device attachment privileges to trusted administrators until patched kernels are deployed
Patch Information
The vulnerability is resolved upstream by removing the erroneous sizeof(struct zpci_gaite) multiplication in kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward(). Fixes have been merged across multiple stable branches. See the upstream patches: commit 11b8ff5b930b, commit 16d990a15491, commit 31a9d9f99428, commit a99a25db131e, commit b22a2da8792a, and commit e7216651b94e.
Workarounds
- Disable zPCI passthrough for guest VMs on unpatched hosts to avoid exercising the affected AIF code paths
- Reduce ZPCI_NR_DEVICES in kernel configuration where feasible to keep aisb values below the threshold that triggers out-of-bounds access
- Limit guest privileges so untrusted workloads cannot invoke KVM ioctls that toggle AIF enable or disable
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
