Skip to main content

Linux Kernel EUVDEUVD-2026-38836

| CVE-2026-52968 HIGH
Out-of-bounds Read (CWE-125)
2026-06-24 Linux GHSA-8vvj-3j37-6m3p
Buffer Overflow Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.8 HIGH

Local, low-priv, no-interaction access to KVM AIF paths on s390; OOB read leaks memory (C:H) and OOB writes to GAIT corrupt kernel state (I:H) and can crash the host (A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat
6.4 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 14, 2026 - 21:05 vuln.today
CVSS changed
Jul 14, 2026 - 20:22 NVD
7.1 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 nvd
HIGH 7.1
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() index the GAIT by manually multiplying the index with sizeof(struct zpci_gaite).

Since aift->gait is already a struct zpci_gaite pointer, this double-scales the offset, accessing element aisb*16 instead of aisb.

This causes out-of-bounds accesses when aisb >= 32 (with ZPCI_NR_DEVICES=512)

Fix by removing the erroneous sizeof multiplication.

AnalysisAI

Out-of-bounds memory access in the Linux kernel's KVM s390 PCI adapter-interrupt-forwarding (AIF) code allows a low-privileged local actor on IBM Z (s390x) hosts to read and corrupt kernel memory. The flaw stems from double-scaled pointer arithmetic when indexing the GAIT table in kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward(), triggered when an adapter interrupt source (aisb) index reaches 32 or higher under ZPCI_NR_DEVICES=512. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.18%, 8th percentile).

Technical ContextAI

This bug lives in the s390-specific KVM PCI passthrough subsystem (arch/s390/kvm), which implements Adapter Interrupt Forwarding (AIF) so that PCI adapter interrupts from pass-through devices can be delivered to guests. The Guest Adapter Interrupt Table (GAIT) is an array of struct zpci_gaite entries. Because aift->gait is already typed as a struct zpci_gaite pointer, C pointer arithmetic already scales an index by sizeof(struct zpci_gaite); the code additionally multiplied the index by sizeof(struct zpci_gaite) manually, so an intended access at element aisb instead landed at element aisb*16. This is a classic CWE-125 out-of-bounds read (and, given writes to GAIT entries during enable/disable, out-of-bounds write) rooted in incorrect array-index scaling rather than a missing bounds check. The affected CPE is the Linux kernel (cpe:2.3:a:linux:linux); exploitation is confined to s390x hosts with vfio-pci/zPCI passthrough and KVM enabled.

RemediationAI

Upgrade to a patched stable kernel: Vendor-released patch - 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10 (and 7.1), whichever matches your series, via your distribution's kernel updates or the stable commits at git.kernel.org/stable/c/31a9d9f9942885aae356a1a57c79e82c5b5b0828. The one-line fix removes the erroneous sizeof(struct zpci_gaite) multiplication in the GAIT index calculation. If you cannot patch immediately, the practical compensating control is to avoid the vulnerable code path by not enabling s390 PCI device passthrough (AIF) to guests - do not assign zPCI devices via vfio-pci to KVM guests, or reduce ZPCI_NR_DEVICES so that no aisb index reaches 32; the trade-off is loss of PCI passthrough functionality for affected guests. Restricting which users can create/manage KVM guests with device passthrough further limits exposure. Reference the advisories at https://nvd.nist.gov/vuln/detail/CVE-2026-52968 and https://vuldb.com/vuln/373319.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38836 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy