Database/Kernel, userspace & hypervisor
Linux kernel KVM s390 vsie: stale crypto bits let a nested guest reach a revoked crypto device
Impact
When shadowing a format0 APCB from crycb 0 or 1, bits 64..255 were left at whatever the vsie page already held, so a nested guest could retain access to a crypto adapter domain that had been taken away from it. On a multi-tenant host this is a cross-tenant reach into an adapter the guest is no longer entitled to. Exposure is narrow: this is s390 (IBM Z) only and requires nested virtualization (vsie), so an x86 or ARM GPU fleet is not affected at all. Listed for completeness for operators who run KVM on Z alongside accelerator workloads.
Who can reach it
Local: a guest running a nested guest under KVM on s390 hardware with crypto adapters passed through. No remote path; requires the host to permit nested virtualization and crypto passthrough.
What to do
Take the stable kernel fix (five backport commits are linked in the record) and reboot the host; a KVM host kernel change cannot be applied without draining guests. No mitigation is documented short of disabling nested virtualization or crypto passthrough for guests.
References
Related entries
- Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedCVE-2021-47136 · Linux kernel mlx5_core representor TC path + net/sched tc extensionHigh
- Linux kernel (net/tls): When a BPF socket policy shrinks the plaintext after the ciphertext length was computed, kTLSCVE-2025-38608 · Linux kernel (net/tls)High
- Linux kernel libceph: truncated monitor reply decodes stale bytes from the reused bufferCVE-2026-68433 · Linux kernel libceph (MON_GET_VERSION_REPLY decode bound)High
- sudo: intercept policy checks skipped for execveat, letting allowed users run denied commandsCVE-2026-82474 · sudo (ptrace-based intercept mode, execveat/fexecve path)High
- Linux kernel (arch/x86/kvm/svm): Hardware ignores the low five bits of CR3 when loading PDPTEs, but KVM's nested SVMCVE-2024-50115 · Linux kernel (arch/x86/kvm/svm)High
- Linux kernel arm_ffa: unvalidated notification layout drives out-of-bounds read of the shared RX bufferCVE-2026-64081 · Linux kernel arm_ffa (Arm FF-A framework notification parsing)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.