{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74515", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.910Z", "datePublished": "2026-08-15T12:27:35.567Z", "dateUpdated": "2026-08-19T16:38:14.487Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:38:14.487Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Reject adapter interrupt forwarding if already enabled\n\nThe MPCIFC instruction doesn't allow registering adapter interrupts without\nfirst unregistering. So reject any request to enable interrupt forwarding\nif its already enabled for the zPCI device. This also fixes overwriting and\nthus leaking resources when the ioctl is called multiple times for the same\ndevice."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through the KVM_S390_ZPCI_OP VM ioctl in arch/s390/kvm/kvm-s390.c; on IBM Z with zPCI passthrough, QEMU forwards guest mpcifc adapter-interrupt registration to this local ioctl path, not over the network.\nAC:L - An attacker with an assigned zPCI device can call KVM_S390_ZPCIOP_REG_AEN twice in a row without racing or special memory layout; each duplicate call deterministically re-enters kvm_s390_pci_aif_enable() and overwrites host bookkeeping.\nPR:L - Exploitation requires a KVM VM file descriptor and a VFIO-assigned zPCI device, i.e. control of the guest/VMM process (typical cloud tenant or qemu user), not init-namespace root; this cannot be reached from an unprivileged user namespace alone.\nUI:N - Once zPCI passthrough is configured, the guest or its VMM can issue duplicate registration on its own; no additional host administrator or victim user action is needed beyond normal device setup.\nS:C - A guest-triggered ioctl corrupts host-owned AIFT/GAITE state outside the VM security boundary, leaving orphaned summary-index entries that the host interrupt path later dereferences in hypervisor context.\nC:H - Duplicate enable overwrites zdev->aisb and leaks earlier GAITE/AIBV resources; on teardown aift->kzdev[orphaned_si] still points at freed kvm_zdev/kvm, so aen_host_forward() performs UAF reads of host hypervisor memory.\nI:H - Stale orphaned GAITE entries retain guest-chosen physical addresses and dangling kzdev pointers; aen_host_forward() can execute set_bit_inv() and further host-side writes through those corrupted structures during adapter-event delivery.\nA:H - Each duplicate REG_AEN leaks pinned guest pages, AIBV allocations, and summary bits without rollback when MPCIFC re-registration fails, enabling repeatable host memory exhaustion and kernel oops/panic via IRQ-time UAF dereferences."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/kvm/pci.c"], "versions": [{"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70", "status": "affected", "versionType": "git"}, {"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "78d9648e7e960546d5b72504a0b0358cd8bb1e9d", "status": "affected", "versionType": "git"}, {"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "6be1ff49ba81f96a6fa55915e6d920be43ac57cc", "status": "affected", "versionType": "git"}, {"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "6837f0ae85fd54cf64c8a0c7c530bba2fae0a207", "status": "affected", "versionType": "git"}, {"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "591952b63a9f976da7d49f719f36ec826ee2a575", "status": "affected", "versionType": "git"}, {"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "8fa01be5a6149404adb82c0979a78f6347edd3ef", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/kvm/pci.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70"}, {"url": "https://git.kernel.org/stable/c/78d9648e7e960546d5b72504a0b0358cd8bb1e9d"}, {"url": "https://git.kernel.org/stable/c/6be1ff49ba81f96a6fa55915e6d920be43ac57cc"}, {"url": "https://git.kernel.org/stable/c/6837f0ae85fd54cf64c8a0c7c530bba2fae0a207"}, {"url": "https://git.kernel.org/stable/c/591952b63a9f976da7d49f719f36ec826ee2a575"}, {"url": "https://git.kernel.org/stable/c/8fa01be5a6149404adb82c0979a78f6347edd3ef"}], "title": "KVM: s390: pci: Reject adapter interrupt forwarding if already enabled", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/s390/kvm/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70", "status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "versionType": "git"}, {"lessThan": "78d9648e7e960546d5b72504a0b0358cd8bb1e9d", "status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "versionType": "git"}, {"lessThan": "6be1ff49ba81f96a6fa55915e6d920be43ac57cc", "status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "versionType": "git"}, {"lessThan": "6837f0ae85fd54cf64c8a0c7c530bba2fae0a207", "status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "versionType": "git"}, {"lessThan": "591952b63a9f976da7d49f719f36ec826ee2a575", "status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "versionType": "git"}, {"lessThan": "8fa01be5a6149404adb82c0979a78f6347edd3ef", "status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/s390/kvm/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Reject adapter interrupt forwarding if already enabled\n\nThe MPCIFC instruction doesn't allow registering adapter interrupts without\nfirst unregistering. So reject any request to enable interrupt forwarding\nif its already enabled for the zPCI device. This also fixes overwriting and\nthus leaking resources when the ioctl is called multiple times for the same\ndevice."}], "id": "CVE-2026-74515", "lastModified": "2026-08-19T17:21:08.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T13:17:56.630", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/591952b63a9f976da7d49f719f36ec826ee2a575"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6837f0ae85fd54cf64c8a0c7c530bba2fae0a207"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6be1ff49ba81f96a6fa55915e6d920be43ac57cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/78d9648e7e960546d5b72504a0b0358cd8bb1e9d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8fa01be5a6149404adb82c0979a78f6347edd3ef"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled", "id": "2517006", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517006"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: s390: pci: Reject adapter interrupt forwarding if already enabled\nThe MPCIFC instruction doesn't allow registering adapter interrupts without\nfirst unregistering. So reject any request to enable interrupt forwarding\nif its already enabled for the zPCI device. This also fixes overwriting and\nthus leaking resources when the ioctl is called multiple times for the same\ndevice.", "A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) s390 PCI component. This vulnerability arises from improper handling of adapter interrupt forwarding, where enabling it multiple times for a zPCI device without prior unregistration can lead to resource overwriting and leakage. An attacker could potentially exploit this to cause information disclosure or system instability."], "name": "CVE-2026-74515", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74515\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74515\nhttps://lore.kernel.org/linux-cve-announce/2026081543-CVE-2026-74515-dcb8@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc,78d9648e7e960546d5b72504a0b0358cd8bb1e9d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc,6be1ff49ba81f96a6fa55915e6d920be43ac57cc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc,6837f0ae85fd54cf64c8a0c7c530bba2fae0a207)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc,591952b63a9f976da7d49f719f36ec826ee2a575)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc,8fa01be5a6149404adb82c0979a78f6347edd3ef)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.151,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T14:45:03.921974+00:00", "updated": "2026-08-21T20:00:13.949922+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-772"]}