CVE-2026-80684 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when dereferenced in kvm_zpci_set_airq(). Add a NULL check and free the previously allocated AISB bit and zdev->aisb on failure.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel's KVM implementation for IBM Z architecture contains a critical flaw within its PCI device handling subsystem, specifically concerning the allocation of adapter interrupt vector structures. The vulnerability arises from an unchecked return value in the airq_iv_create function, which is responsible for initializing the adapter interrupt block vector (AIBV) data structure used to manage hardware interrupts for virtualized PCI devices. Under normal operation, this function allocates necessary memory and returns a pointer to the newly created structure. However, due to resource constraints such as memory pressure or fragmentation, airq_iv_create can fail and return NULL instead of a valid pointer. The existing code logic fails to validate whether this allocation was successful before proceeding with subsequent operations that rely on the integrity of this data structure.
This oversight leads directly to a null pointer dereference vulnerability when the system attempts to configure adapter interrupts via kvm_zpci_set_airq. When airq_iv_create returns NULL, the zdev->aibv field remains unset or is set to an invalid state depending on prior initialization steps, but critically, subsequent code assumes it holds a valid memory address. Consequently, any attempt to dereference this pointer triggers a kernel panic or undefined behavior, effectively causing a denial of service against the host system running the KVM hypervisor. This type of error falls squarely under CWE-476, which describes NULL Pointer Dereferences, and is often associated with improper input validation where external conditions like memory availability are not adequately accounted for in control flow logic.
The operational impact of this vulnerability is significant for environments relying on IBM Z systems to host virtual machines with assigned PCI devices. An attacker or a workload that induces high resource contention could potentially trigger the allocation failure, leading to system instability. While exploitation typically requires local access to initiate specific device configurations under stress conditions, the resulting kernel crash disrupts all running services and VMs on the affected host. This aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, as it allows for the disruption of availability through resource exhaustion leading to a system fault. The vulnerability highlights the importance of defensive programming practices where every allocation call must be verified before use, especially in kernel-space code where memory management is manual and errors have severe consequences.
To mitigate this risk, developers implemented a robust fix that includes explicit validation of the return value from airq_iv_create. If the function returns NULL, indicating an allocation failure, the corrected logic now properly handles the error path by freeing any previously allocated resources associated with the adapter interrupt block (AISB) and the zdev->aisb structure to prevent memory leaks. This ensures that even in failure scenarios, the system maintains resource integrity without leaking kernel memory. Administrators should ensure their systems are updated with patches containing this fix. Furthermore, monitoring for out-of-memory conditions or high-pressure allocation environments can help identify potential triggers before they result in a crash. Regular auditing of code paths involving dynamic memory allocation is essential to prevent similar null pointer dereferences in other subsystems.