CVE-2026-74515 (GCVE-0-2026-74515)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-08-19 16:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
The MPCIFC instruction doesn't allow registering adapter interrupts without
first unregistering. So reject any request to enable interrupt forwarding
if its already enabled for the zPCI device. This also fixes overwriting and
thus leaking resources when the ioctl is called multiple times for the same
device.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc Version: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc Version: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc Version: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc Version: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc Version: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "78d9648e7e960546d5b72504a0b0358cd8bb1e9d",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "6be1ff49ba81f96a6fa55915e6d920be43ac57cc",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "6837f0ae85fd54cf64c8a0c7c530bba2fae0a207",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "591952b63a9f976da7d49f719f36ec826ee2a575",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "8fa01be5a6149404adb82c0979a78f6347edd3ef",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Reject adapter interrupt forwarding if already enabled\n\nThe MPCIFC instruction doesn\u0027t allow registering adapter interrupts without\nfirst unregistering. So reject any request to enable interrupt forwarding\nif its already enabled for the zPCI device. This also fixes overwriting and\nthus leaking resources when the ioctl is called multiple times for the same\ndevice."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through the KVM_S390_ZPCI_OP VM ioctl in arch/s390/kvm/kvm-s390.c; on IBM Z with zPCI passthrough, QEMU forwards guest mpcifc adapter-interrupt registration to this local ioctl path, not over the network.\nAC:L - An attacker with an assigned zPCI device can call KVM_S390_ZPCIOP_REG_AEN twice in a row without racing or special memory layout; each duplicate call deterministically re-enters kvm_s390_pci_aif_enable() and overwrites host bookkeeping.\nPR:L - Exploitation requires a KVM VM file descriptor and a VFIO-assigned zPCI device, i.e. control of the guest/VMM process (typical cloud tenant or qemu user), not init-namespace root; this cannot be reached from an unprivileged user namespace alone.\nUI:N - Once zPCI passthrough is configured, the guest or its VMM can issue duplicate registration on its own; no additional host administrator or victim user action is needed beyond normal device setup.\nS:C - A guest-triggered ioctl corrupts host-owned AIFT/GAITE state outside the VM security boundary, leaving orphaned summary-index entries that the host interrupt path later dereferences in hypervisor context.\nC:H - Duplicate enable overwrites zdev-\u003eaisb and leaks earlier GAITE/AIBV resources; on teardown aift-\u003ekzdev[orphaned_si] still points at freed kvm_zdev/kvm, so aen_host_forward() performs UAF reads of host hypervisor memory.\nI:H - Stale orphaned GAITE entries retain guest-chosen physical addresses and dangling kzdev pointers; aen_host_forward() can execute set_bit_inv() and further host-side writes through those corrupted structures during adapter-event delivery.\nA:H - Each duplicate REG_AEN leaks pinned guest pages, AIBV allocations, and summary bits without rollback when MPCIFC re-registration fails, enabling repeatable host memory exhaustion and kernel oops/panic via IRQ-time UAF dereferences."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:38:14.487Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70"
},
{
"url": "https://git.kernel.org/stable/c/78d9648e7e960546d5b72504a0b0358cd8bb1e9d"
},
{
"url": "https://git.kernel.org/stable/c/6be1ff49ba81f96a6fa55915e6d920be43ac57cc"
},
{
"url": "https://git.kernel.org/stable/c/6837f0ae85fd54cf64c8a0c7c530bba2fae0a207"
},
{
"url": "https://git.kernel.org/stable/c/591952b63a9f976da7d49f719f36ec826ee2a575"
},
{
"url": "https://git.kernel.org/stable/c/8fa01be5a6149404adb82c0979a78f6347edd3ef"
}
],
"title": "KVM: s390: pci: Reject adapter interrupt forwarding if already enabled",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74515",
"datePublished": "2026-08-15T12:27:35.567Z",
"dateReserved": "2026-08-15T05:44:03.910Z",
"dateUpdated": "2026-08-19T16:38:14.487Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…