High 8.8Published Jun 24, 2026

CVE-2026-52968KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

Updated under an hour ago (Oct 27, 2026, 3:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() index the GAIT by manually multiplying the index with sizeof(struct zpci_gaite). Since aift->gait is already a struct zpci_gaite pointer, this double-scales the offset, accessing element aisb*16 instead of aisb. This causes out-of-bounds accesses when aisb >= 32 (with ZPCI_NR_DEVICES=512) Fix by removing the erroneous sizeof multiplication.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	73f91b004321f2510fa79e66035dbbf1870fcf56 builds before 31a9d9f9942885aae356a1a57c79e82c5b5b0828; from 73f91b004321f2510fa79e66035dbbf1870fcf56 before a99a25db131ece5e6c0f7632da606de631efe4f2; 73f91b004321f2510fa79e66035dbbf1870fcf56 builds before 11b8ff5b930b351dd1f6f088dce0beb027ac92d0; from 73f91b004321f2510fa79e66035dbbf1870fcf56 before b22a2da8792a7bfe743c1a922e77fa499ddedbe8; from 73f91b004321f2510fa79e66035dbbf1870fcf56 before e7216651b94e92e5433fb2f54b77864642b4ea48; 73f91b004321f2510fa79e66035dbbf1870fcf56 builds before 16d990a15491cf76cd6eef0846e1b4100e63261a	CNA record
linux linux_kernel linux:linux_kernel	from 6.0 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10; 7.1; 7.1; 7.1	NVD

References

References

https://git.kernel.org/stable/c/31a9d9f9942885aae356a1a57c79e82c5b5b0828	patch
https://git.kernel.org/stable/c/a99a25db131ece5e6c0f7632da606de631efe4f2	patch
https://git.kernel.org/stable/c/11b8ff5b930b351dd1f6f088dce0beb027ac92d0	patch
https://git.kernel.org/stable/c/b22a2da8792a7bfe743c1a922e77fa499ddedbe8	patch
https://git.kernel.org/stable/c/e7216651b94e92e5433fb2f54b77864642b4ea48	patch
https://git.kernel.org/stable/c/16d990a15491cf76cd6eef0846e1b4100e63261a	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.