CVE-2026-80921: Linux Kernel KVM Privilege Escalation

CVE-2026-80921 Overview

CVE-2026-80921 is a vulnerability in the Linux kernel affecting the KVM (Kernel-based Virtual Machine) subsystem on IBM s390 architecture. The flaw resides in the virtual SIE (vsie) code path that shadows crypto access bits from a format0 APCB (Adjunct Processor Control Block). When shadowing crycb 0 or 1, bits 64 through 255 remain unchanged from prior values in the vsie page, exposing stale crypto configuration to nested guests. The kernel maintainers resolved the issue by explicitly zeroing the remaining bits before use.

Critical Impact
A nested guest on s390 KVM can gain access to cryptographic adapter or domain resources that should no longer be available, resulting in unauthorized access to sensitive crypto devices with high confidentiality, integrity, and availability impact.

Affected Products

Linux kernel (KVM subsystem for s390/IBM Z architecture)
Virtualized environments running nested guests on s390 hosts
Multiple stable branches — fixes released across nine kernel stable commits

Discovery Timeline

2026-09-09 - CVE-2026-80921 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80921

Vulnerability Analysis

The vulnerability exists in the s390 KVM vsie (virtual Start Interpretive Execution) implementation, which enables nested virtualization on IBM Z systems. The vsie handler shadows the guest's Crypto Control Block (CRYCB) so that a nested guest can access cryptographic adapters and domains. When the guest supplies a format0 APCB (crycb format 0 or 1), only bits 0 through 63 are defined for that format. The kernel copied these defined bits but left bits 64 through 255 untouched in the shadow page.

Because the vsie page is reused across operations, those residual bits reflect prior crypto access grants. A nested guest inherits access rights it was never granted, potentially reaching AP (Adjunct Processor) queues or crypto domains that have since been removed from its configuration. The fix explicitly zeroes bits 64 through 255 during shadowing, ensuring only currently authorized crypto resources remain accessible.

Root Cause

The root cause is improper initialization of a data structure during shadow copy. The APCB shadow logic for format0 layouts assumed unused bit ranges would be inert, but the underlying memory retained stale values from previous vsie operations. This is an uninitialized memory reuse pattern within a security-sensitive translation path.

Attack Vector

Exploitation requires local, authenticated access as a KVM guest on an s390 host running nested virtualization. The attacker operates a Level-1 guest that in turn launches a Level-2 (nested) guest. By crafting or observing the APCB shadowing behavior, the nested guest gains crypto access bits carried over from prior vsie invocations. The scope is changed because the vulnerability crosses the boundary between the nested guest and crypto resources managed by the host hypervisor.

No verified public exploit code is available for this vulnerability. See the Kernel Stable Commit d4bcd2d for the reference fix.

Detection Methods for CVE-2026-80921

Indicators of Compromise

Unexpected access to AP (Adjunct Processor) queues or crypto domains from nested guests that do not have those resources configured
Anomalous crypto operation success from Level-2 guests on s390 KVM hosts running unpatched kernels
Kernel version strings on s390 hosts predating the stable commits referenced in this advisory

Detection Strategies

Inventory all s390/IBM Z hosts running KVM with nested virtualization enabled and cross-reference kernel versions against the patched stable releases
Audit guest configurations to identify which Level-1 guests can launch nested guests and which have crypto passthrough enabled
Monitor /sys/devices/ap/ and vfio-ap logs on the host for crypto access patterns inconsistent with the declared guest configuration

Monitoring Recommendations

Enable KVM tracepoints for vsie handling on s390 hosts and review shadow CRYCB creation events
Alert on new nested-guest instantiation on hosts that also expose crypto adapters via vfio-ap
Track kernel package updates across the s390 fleet and flag hosts still running vulnerable kernel builds

How to Mitigate CVE-2026-80921

Immediate Actions Required

Apply the upstream kernel patch or vendor-supplied backport to all s390 KVM hosts running nested virtualization
Restrict which Level-1 guests are permitted to run nested guests until patched kernels are deployed
Review and tighten vfio-ap crypto passthrough assignments so that removed adapters are fully revoked at the host level

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches. Reference commits include 087c19c, 29b4f7b, 34d5b5b, 59d5155, 7d23489, 935eeba, d110b32, d4bcd2d, and f6079dc. Consult your Linux distribution vendor for backported package versions.

Workarounds

Disable nested virtualization on s390 KVM hosts by unloading or reconfiguring the kvm module without the nested=1 parameter until patches are applied
Remove crypto adapter passthrough from Level-1 guests that host nested workloads to eliminate the sensitive resource exposure
Isolate untrusted tenant workloads onto hosts that do not permit nested guests with crypto access

bash

# Verify nested KVM status on s390 and disable if needed
cat /sys/module/kvm/parameters/nested
# To disable nested virtualization until patches are applied:
echo 'options kvm nested=0' | sudo tee /etc/modprobe.d/kvm-s390.conf
sudo rmmod kvm && sudo modprobe kvm