PT-2026-51862 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-52968

Mitre

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

kvm s390 pci aif enable(), kvm s390 pci aif disable(), and aen host forward() index the GAIT by manually multiplying the index with sizeof(struct zpci gaite).

Since aift->gait is already a struct zpci gaite pointer, this double-scales the offset, accessing element aisb*16 instead of aisb.

This causes out-of-bounds accesses when aisb >= 32 (with ZPCI NR DEVICES=512)

Fix by removing the erroneous sizeof multiplication.

Related Identifiers

CVE-2026-52968

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-52968 · Security Note
• https://git.kernel.org/stable/c/11b8ff5b930b351dd1f6f088dce0beb027ac92d0 · Note
• https://git.kernel.org/stable/c/16d990a15491cf76cd6eef0846e1b4100e63261a · Note
• https://git.kernel.org/stable/c/a99a25db131ece5e6c0f7632da606de631efe4f2 · Note
• https://git.kernel.org/stable/c/e7216651b94e92e5433fb2f54b77864642b4ea48 · Note
• https://git.kernel.org/stable/c/b22a2da8792a7bfe743c1a922e77fa499ddedbe8 · Note
• https://git.kernel.org/stable/c/31a9d9f9942885aae356a1a57c79e82c5b5b0828 · Note