CVE-2026-80921

In the Linux kernel's KVM implementation for the s390 (IBM Z) architecture, the nested-virtualization ('vsie') code fails to clear bits 64-255 of the crypto access-control block when shadowing a format-0 APCB (crycb 0 or 1), leaving whatever stale bits are present in the vsie page in place. As a result, a nested (L2) guest can retain access to cryptographic devices (crypto adapters) that are no longer available or permitted to it. An attacker with low privileges inside such a nested guest could gain unauthorized use of cryptographic hardware, with high potential confidentiality, integrity, and availability impact (CVSS 3.1: 8.8, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Only operators of KVM hosts on IBM Z/LinuxONE systems with nested virtualization enabled and crypto pass-through configured are affected; other architectures are not impacted. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not in the CISA KEV catalog.

What to do: Apply the kernel fix ('KVM: s390: vsie: zero stale crypto bits') via your distribution's stable/long-term kernel update, and track vendor advisories for exact fixed versions since none are specified in the disclosure. As interim mitigation, disable nested virtualization on s390 KVM hosts or stop pass-through of crypto adapters (AP) to nested guests, and audit whether nested guests retained access to crypto devices they should no longer use.