Description

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when dereferenced in kvm_zpci_set_airq(). Add a NULL check and free the previously allocated AISB bit and zdev->aisb on failure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-28T08:16:53.857Z",
  "pubdate": "2026-08-28T08:16:53.857Z",
  "executiveSummary": "A NULL pointer dereference vulnerability exists within the KVM subsystem of the Linux kernel on the s390 architecture, specifically concerning PCI device management.\nThe vulnerability occurs due to the lack of error handling when allocating memory for the Adapter Interrupt Bit Vector (AIBV).\nIf the airq_iv_create() function fails, the kernel proceeds to dereference a NULL pointer within the kvm_zpci_set_airq() function, leading to a kernel panic.\nThis flaw can be exploited to trigger a Denial of Service (DoS) condition, effectively crashing the host or the affected virtual machine.\nThe risk is categorized as critical for system availability, as it allows for an unauthenticated local user or process with sufficient privileges to induce a system crash by triggering specific hardware-related operations.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of return values within the PCI interrupt registration logic for s390 KVM guest pass-through devices.\nSpecifically, the function airq_iv_create() is responsible for allocating and initializing the AIBV; however, the implementation fails to validate whether this function returns a NULL pointer under memory pressure or allocation exhaustion scenarios.\nWhen airq_iv_create() fails, the pointer zdev->aibv remains NULL. In the subsequent control flow, the function kvm_zpci_set_airq() attempts to access the members of the AIBV structure pointed to by zdev->aibv.\nBecause there is no conditional check to verify the validity of the pointer before dereferencing it, the CPU attempts to access address 0x0, which triggers a kernel oops or a panic due to a page fault in kernel mode.\nFurthermore, the cleanup process upon failure is incomplete; when the allocation of the AIBV fails, the kernel does not properly release the previously allocated Adapter Interrupt Suppression Bit (AISB) and the associated zdev->aisb structure. This leads to a memory leak in addition to the instability.\nExploitation involves an attacker initiating a sequence of PCI device operations that force the kernel to allocate these interrupt structures. If an attacker can reliably trigger memory exhaustion or otherwise influence the allocation failure for the AIBV while the AISB allocation succeeds, they can force the kernel to enter the erroneous code path.\nThe impact of a successful exploitation is a system-wide denial of service. Since this occurs within the kernel context, there is no mechanism for the operating system to gracefully recover from the NULL pointer dereference, resulting in an immediate termination of the process or a total system hang, depending on the kernel configuration and the nature of the fault.\nAffected versions include any Linux kernel version implementing the s390 PCI virtualization logic that lacks the explicit check for the return value of airq_iv_create() within the ZPCI interrupt registration path."
}