PT-2026-51862 · Linux · Linux

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-52968

Mitre

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

kvm s390 pci aif enable(), kvm s390 pci aif disable(), and aen host forward() index the GAIT by manually multiplying the index with sizeof(struct zpci gaite).

Since aift->gait is already a struct zpci gaite pointer, this double-scales the offset, accessing element aisb*16 instead of aisb.

This causes out-of-bounds accesses when aisb >= 32 (with ZPCI NR DEVICES=512)

Fix by removing the erroneous sizeof multiplication.

Identificadores relacionados

CVE-2026-52968

Produtos afetados

Linux

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-52968 · Nota de Segurança
• https://git.kernel.org/stable/c/11b8ff5b930b351dd1f6f088dce0beb027ac92d0 · Nota
• https://git.kernel.org/stable/c/16d990a15491cf76cd6eef0846e1b4100e63261a · Nota
• https://git.kernel.org/stable/c/a99a25db131ece5e6c0f7632da606de631efe4f2 · Nota
• https://git.kernel.org/stable/c/e7216651b94e92e5433fb2f54b77864642b4ea48 · Nota
• https://git.kernel.org/stable/c/b22a2da8792a7bfe743c1a922e77fa499ddedbe8 · Nota
• https://git.kernel.org/stable/c/31a9d9f9942885aae356a1a57c79e82c5b5b0828 · Nota