CVE-2026-80684: Linux Kernel KVM Use-After-Free Vulnerability

CVE-2026-80684 Overview

CVE-2026-80684 is a NULL pointer dereference vulnerability in the Linux kernel's KVM subsystem for the s390 (IBM Z) architecture. The flaw resides in the PCI passthrough code path, where airq_iv_create() can return NULL on allocation failure. The kernel never checked this return value, leaving zdev->aibv unset and causing a NULL dereference when kvm_zpci_set_airq() later accessed the structure. The upstream fix adds a NULL check and frees the previously allocated Adapter Interrupt Summary Bit (AISB) and zdev->aisb on failure.

Critical Impact
A local attacker triggering the failure path in KVM s390 PCI adapter interrupt setup can crash the host kernel and impact confidentiality, integrity, and availability across guest boundaries.

Affected Products

Linux kernel with KVM enabled on the s390 (IBM Z) architecture
Kernel builds exposing PCI passthrough (arch/s390/kvm/pci) to virtual machines
Distributions shipping affected mainline and stable kernel branches prior to the referenced patch commits

Discovery Timeline

2026-08-28 - CVE-2026-80684 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80684

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the s390 KVM PCI adapter interrupt initialization code. When a guest is configured for PCI passthrough on IBM Z, the kernel allocates an Adapter Interrupt Bit Vector (AIBV) through airq_iv_create(). That helper can return NULL when memory allocation fails or when internal constraints cannot be satisfied.

The original code path stored the return value in zdev->aibv without validating it. Control flow then reached kvm_zpci_set_airq(), which dereferences zdev->aibv to program adapter interrupt registration with the hypervisor. Dereferencing NULL in kernel context produces an oops, terminating the affected kernel path and destabilizing the host.

Root Cause

The root cause is a missing return-value check after a fallible allocation. airq_iv_create() follows kernel convention by returning NULL on failure, but the caller assumed success. Additionally, the AISB bit and zdev->aisb allocated earlier in the same sequence were leaked when the AIBV allocation failed, compounding the defect with a partial-initialization state.

Attack Vector

Exploitation requires local access on an s390 host running KVM with PCI passthrough enabled. A local user or a privileged guest management workflow that can trigger repeated adapter setup under memory pressure can force the failing allocation. Because the failure originates in the host kernel and the scope changes across the virtualization boundary, the impact extends beyond the initiating context, which explains the high confidentiality, integrity, and availability impact classification.

No verified public exploit code is available. See the upstream kernel patches for the corrected control flow: Kernel Patch 0a95abe9644 and Kernel Patch e137d082325.

Detection Methods for CVE-2026-80684

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing kvm_zpci_set_airq or the s390 PCI interrupt path
Unexpected KVM guest termination on s390 hosts coinciding with adapter interrupt setup
Repeated allocation failure warnings from airq_iv_create() under memory pressure

Detection Strategies

Inventory s390/IBM Z hosts and identify kernel versions predating the fix commits 0a95abe9644, 8bf09b9b7d3, 96099486b63, d1a103dc901, df947d85e16, and e137d082325.
Correlate host kernel crashes with guest lifecycle events such as PCI device attach or hotplug in KVM management logs.
Monitor for privileged local processes performing rapid PCI adapter attach/detach cycles that could induce allocation failure paths.

Monitoring Recommendations

Ship kernel logs and dmesg output to a centralized platform to detect oops signatures tied to kvm_zpci_set_airq.
Alert on host reboots or KVM service restarts on s390 systems, and correlate with virtual machine configuration changes.
Track kernel package versions across the fleet and flag hosts missing the referenced stable patches.

How to Mitigate CVE-2026-80684

Immediate Actions Required

Apply the vendor-provided kernel update that includes the referenced upstream commits on all s390 KVM hosts.
Restrict local access on IBM Z hypervisors to trusted administrators until patched kernels are deployed.
Reduce PCI passthrough exposure to untrusted guest workloads while remediation is in progress.

Patch Information

The fix adds a NULL check for the airq_iv_create() return value and releases the previously allocated AISB bit and zdev->aisb on failure. Stable patches are available as Kernel Patch 0a95abe9644, Kernel Patch 8bf09b9b7d3, Kernel Patch 96099486b63, Kernel Patch d1a103dc901, Kernel Patch df947d85e16, and Kernel Patch e137d082325. Rebuild affected distribution kernels or install vendor-supplied updates that incorporate these commits.

Workarounds

Disable KVM PCI passthrough on s390 hosts until the patched kernel is deployed, if operationally feasible.
Limit privileged guest management APIs to a minimal set of administrators to reduce the chance of triggering the failure path.
Ensure adequate host memory headroom to reduce the probability of airq_iv_create() allocation failures while patching is scheduled.

bash

# Verify running kernel version and check for the fix on s390 hosts
uname -r
rpm -q --changelog kernel | grep -E "0a95abe9644|8bf09b9b7d3|e137d082325"
# Debian/Ubuntu equivalent
dpkg -l | grep linux-image
apt-get update && apt-get install --only-upgrade linux-image-$(uname -r)