EUVD-2026-75098
GHSA-337q-m32v-p95j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AC:H because stale vsie page content depends on prior allocation state, not reliably present; otherwise consistent with provided vector.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: vsie: zero stale crypto bits
When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.
Articles & Coverage 1
AnalysisAI
Unauthorized cryptographic hardware access in KVM for s390 (IBM Z) nested virtualization allows a low-privileged nested guest to access AP queues (hardware crypto devices) that were explicitly revoked from its allocation. When the KVM VSIE subsystem shadows a format0 APCB (Adjunct Processor Control Block) from a crycb type 0 or 1 structure, it only copies bits 0-63 but leaves bits 64-255 unchanged from whatever stale state existed in the vsie shadow page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) IBM Z / s390x hardware with hardware AP cryptographic devices (CEX adapters) present and configured; (2) Linux KVM running as the L1 hypervisor with nested virtualization enabled; (3) the vulnerable guest must be launched using a format0 APCB (crycb type 0 or type 1) - not the newer format2/type 3; (4) the vsie shadow page for that guest must contain stale non-zero bits in positions 64-255, which depends on prior page state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 8.8 (High), reflecting a scope-changing local exploit with full CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the patched kernel release for your stable branch: 5.10.269, 5.15.220, 6.1.187, 6.6.156, 6.12.108, 6.18.49, 7.1.13, 7.2.3, or 7.3-rc1 as appropriate. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all KVM deployments on s390 (IBM Z) systems with nested virtualization enabled and document current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today