CVE-2026-52968: Linux Kernel KVM s390 PCI Double-Scaling Pointer Vulnerability (CVSS 8.8)

Technical summary

CVE-2026-52968 is a double-scaling pointer arithmetic vulnerability in the Linux kernel's KVM s390 PCI implementation. The functions kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() manually multiply an index by sizeof(struct zpci_gaite) when indexing into aift->gait, which is already typed as a struct zpci_gaite pointer. This causes the offset calculation to be scaled twice: once implicitly by pointer arithmetic and once explicitly by the manual multiplication. Consequently, accessing element aisb actually reads/writes element aisb*16. When aisb >= 32 with ZPCI_NR_DEVICES=512, this produces out-of-bounds memory access. The vulnerability is classified as CWE-125 (Out-of-bounds Read). Remediation requires removing the erroneous sizeof multiplication to rely solely on pointer arithmetic.

Business impact

On Linux systems running KVM hypervisors for IBM System z architecture (used in enterprise data centers and cloud platforms), this vulnerability enables a local attacker with user-level privileges on a guest virtual machine to corrupt host kernel memory, potentially leading to host system crash, data exfiltration, or escape from the guest context to the hypervisor layer. Organizations operating s390 virtualization environments face risk of service disruption and possible lateral movement between isolated guest systems.

Affected systems

Linux kernel versions containing the vulnerable KVM s390 PCI code are affected. The exposure requires: (1) a system running on IBM System z architecture or KVM on s390; (2) KVM hypervisor enabled; (3) PCI device pass-through or device interrupt handling in use; (4) an attacker with local user-level access to a guest VM. Server and cloud environments using s390 virtualization for mission-critical workloads are the primary targets.

Exploitability

Exploitability is relatively straightforward for a local user with guest VM access. No authentication, user interaction, or complex race conditions are required. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the current date, and no public proof-of-concept code is known to be circulating, but the attack surface is contained to systems with s390/KVM configurations, limiting opportunistic exploitation. The CVSS 3.1 score of 8.8 (HIGH) reflects local attack vector, low complexity, and high impact on confidentiality, integrity, and availability.

Remediation

Remove the manual sizeof(struct zpci_gaite) multiplication in the three affected functions, allowing the kernel's pointer arithmetic to handle scaling automatically. This is a minimal, low-risk code change that corrects the indexing logic without altering control flow or requiring configuration changes. Kernel maintainers have already resolved this issue; users must apply the patched kernel version released for their distribution.

Patch guidance

Identify your Linux kernel version and distribution via 'uname -r'. Check the Linux kernel security advisories or your distribution's security updates (Red Hat, Ubuntu, SUSE, etc.) for the patched kernel version addressing CVE-2026-52968. For s390 KVM deployments, prioritize testing and deploying the patched kernel to hypervisor hosts. Standard kernel update procedures (apt, yum, or zypper) apply. Verify after patching that KVM s390 PCI functionality remains operational in your test environment before production deployment.

Detection guidance

Kernel-level monitoring: enable audit logs for memory access violations or out-of-bounds exceptions in the KVM s390 PCI subsystem. Monitor for unexpected kernel oops or segmentation faults related to zpci_gaite structures or GAIT table operations. Guest-to-host escape attempts may be detectable via hypervisor event logs showing abnormal interrupt handling or device table corruption. Systems without s390 KVM configurations are not affected and require no detection effort. Compile kernel logs for signs of memory corruption during device interrupt processing.

Why prioritize this

Although this vulnerability requires local access and affects a specialized architecture (s390/KVM), the HIGH CVSS score (8.8) and potential for memory corruption and hypervisor compromise make it critical for affected environments. Organizations running IBM System z virtualization must patch urgently to prevent guest-to-host escape and data compromise. Non-s390 deployments can safely defer or skip this patch.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Attack Vector = Local (limited to on-system or guest access); Attack Complexity = Low (no special conditions needed); Privileges Required = Low (guest user context sufficient); User Interaction = None; Scope = Changed (impacts the hypervisor/host); Confidentiality = High (kernel memory disclosure); Integrity = High (memory corruption); Availability = High (system crash). The Changed scope elevates impact from guest to host, justifying the HIGH severity classification despite the local attack vector.

Frequently asked questions