SEPTEMBER 15, 2026
Live Feed
Back to database
Case File

CVE-2026-80684

CRITICAL · CVSS 9.3 EPSS 0.14%

Source: NVD + CISA KEV + EPSS · Published 2026-08-28 · Last synced 2026-09-15

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's KVM subsystem, specifically in the handling of AIBV allocation failures, where a NULL pointer dereference can occur if the airq_iv_create() function fails. This oversight can lead to system instability or crashes when the dereferenced pointer is accessed. Organizations using Linux in virtualized environments, particularly those relying on KVM for s390 architecture, should prioritize addressing this issue to maintain system reliability and security.

CVE
CVE-2026-80684
Severity
CRITICAL
CVSS
9.3
EPSS
0.14%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when dereferenced in kvm_zpci_set_airq(). Add a NULL check and free the previously allocated AISB bit and zdev->aisb on failure.