CVE-2026-80891: Linux Kernel KVM Privilege Escalation Flaw

CVE-2026-80891 Overview

CVE-2026-80891 is a Linux kernel vulnerability in the KVM subsystem for IBM System/390 (s390) architecture. The flaw resides in the PCI passthrough code path where the Adapter Interrupt Bit Vector (AIBV) and Adapter Interrupt Summary Bit (AISB) were pinned into host memory without proper validation. A guest could supply an AIBV whose size crosses a page boundary, or an AISB address that is not 8-byte aligned, violating the s390 architecture requirement for doubleword alignment. The kernel fix rejects such requests before pinning guest pages.

Critical Impact
A malicious or malformed KVM guest on s390 hardware can trigger unsafe pinning of guest pages during PCI interrupt configuration, leading to kernel memory-handling errors.

Affected Products

Linux kernel (upstream) with KVM s390 PCI passthrough support
s390x architecture builds enabling CONFIG_VFIO_PCI with KVM zPCI
Distributions shipping affected stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-09-04 - CVE-2026-80891 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80891

Vulnerability Analysis

The vulnerability affects the KVM s390 PCI interrupt handling logic. The AIBV holds one bit per Message Signaled Interrupts Extended (MSI-X) vector for a given function. Its size derives from the Number of Interrupts (NOI) value and the AIBV Offset (AIBVO). If the computed AIBV size crosses a single page boundary, the kernel previously attempted to pin guest pages spanning that boundary. The AISB summary bit address must be 8-byte aligned because the s390 architecture requires doubleword alignment for the summary bit. Since the AISB Offset (AISBO) can address up to 64 bits, the AISB size is bounded at 8 bytes, which also keeps it within a single page.

Root Cause

The root cause is missing input validation in the zPCI interrupt setup path. The kernel accepted guest-provided AIBV size parameters and AISB addresses without verifying page-boundary constraints or alignment requirements. This is an improper input validation issue tied to guest-controlled parameters used in host memory pinning operations.

Attack Vector

The attack requires a guest with access to KVM PCI passthrough on s390 hardware. A guest that programs an AIBV configuration exceeding a page boundary, or supplies an unaligned AISB address, would previously reach the pinning code with invalid parameters. The patched kernel rejects these requests before any guest page pinning occurs. See the fix commits at Kernel Commit 15df7700 and Kernel Commit 868d32ac for the exact validation logic added.

No verified public exploit code is available for this issue. Refer to the upstream commits for technical details on the parameter validation.

Detection Methods for CVE-2026-80891

Indicators of Compromise

Unexpected KVM zPCI interrupt configuration failures or kernel warnings on s390x hosts
Guest VMs repeatedly attempting to register MSI-X vector configurations with unusual NOI or AIBVO values
Kernel log entries referencing kvm_s390_pci interrupt registration errors

Detection Strategies

Audit host kernel versions on s390x systems and compare against the fixed stable branches referenced in the upstream commits
Monitor dmesg and journald output for zPCI interrupt registration rejections after applying the patch
Correlate guest VFIO-PCI passthrough activity with host memory pinning anomalies

Monitoring Recommendations

Ingest s390x host kernel logs into a centralized logging pipeline and alert on repeated KVM zPCI errors
Track kernel package versions across the s390 fleet to identify unpatched hypervisors
Baseline normal MSI-X configuration behavior for production guest workloads to detect deviation

How to Mitigate CVE-2026-80891

Immediate Actions Required

Identify all s390x hosts running KVM with PCI passthrough enabled for guests
Apply the vendor kernel update containing the referenced upstream commits
Restrict which guests are granted zPCI passthrough until patched kernels are deployed

Patch Information

The fix is delivered via multiple stable-tree backports. Review the changes in Kernel Commit 15df7700, Kernel Commit 3a1c6422, Kernel Commit 868d32ac, Kernel Commit b878ba7e, Kernel Commit f00ef8ef, and Kernel Commit fbfe683f. Deploy the distribution kernel package that incorporates these commits for your stable branch.

Workarounds

Disable KVM PCI passthrough on affected s390x hosts until the patched kernel is installed
Limit guest privileges so untrusted workloads cannot configure zPCI interrupt structures
Where feasible, restrict guest MSI-X configurations to trusted management tooling only