CVE-2026-80684

CVE-2026-80684 is a NULL pointer dereference in the Linux kernel's KVM implementation for s390 (IBM Z) PCI support: airq_iv_create() can return NULL when the adapter interrupt bit vector (AIBV) allocation fails, but the return value was never checked, leaving zdev->aibv set to NULL. A subsequent call to kvm_zpci_set_airq() dereferences the NULL pointer and crashes the host kernel, so the impact is a denial of service on the host, taking down running guests. Triggering the bug requires the AIBV allocation to fail (a rare error path typically tied to memory exhaustion) followed by adapter interrupt setup for a passed-through zPCI device. Only operators running KVM on s390x hosts that use PCI passthrough with zPCI adapter interrupts are affected; the source data lists no specific affected version ranges, so check distribution advisories for the fixed build. Exploitation status: no public proof-of-concept, no CISA KEV listing, and a very low EPSS of 0.1% in 30 days, with no known exploitation in the wild; the CVSS 3.1 base score is 9.3 (critical) with a local attack vector.

What to do: Patch by applying the kernel fix for CVE-2026-80684 as it ships in your distribution's stable/long-term kernel updates; no fixed version number is provided in the source data, so track your vendor's advisory. Exposure is limited to s390x KVM hosts using zPCI passthrough, and triggering requires an AIBV allocation failure under memory pressure, so monitoring and relieving host memory pressure is a partial mitigation. With no known exploitation (EPSS 0.1%, no KEV entry, no public PoC), handling this in the regular patching cycle is reasonable.