{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-52968",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-52968"
  ],
  "published": "2026-06-24T16:31:02Z",
  "summary": "KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic\n\nkvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and\naen_host_forward() index the GAIT by manually multiplying the index\nwith sizeof(struct zpci_gaite).\n\nSince aift->gait is already a struct zpci_gaite pointer, this\ndouble-scales the offset, accessing element aisb*16 instead of aisb.\n\nThis causes out-of-bounds accesses when aisb >= 32 (with\nZPCI_NR_DEVICES=512)\n\nFix by removing the erroneous sizeof multiplication.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.175",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-52968"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/31a9d9f9942885aae356a1a57c79e82c5b5b0828"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a99a25db131ece5e6c0f7632da606de631efe4f2"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/11b8ff5b930b351dd1f6f088dce0beb027ac92d0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b22a2da8792a7bfe743c1a922e77fa499ddedbe8"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e7216651b94e92e5433fb2f54b77864642b4ea48"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/16d990a15491cf76cd6eef0846e1b4100e63261a"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T13:16:28Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 8.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerable code is reached through local KVM/VFIO s390 zPCI management paths, specifically the `KVM_S390_ZPCI_OP` VM ioctl and host interrupt forwarding, not through network packets.\nAC:L - Once zPCI AEN interpretation is available and an AISB index of 32 or higher is allocated, the bad pointer arithmetic deterministically accesses the wrong GAIT entry; no attacker-uncontrolled race is required.\nPR:L - The attacker needs local ability to operate a KVM VM with an associated VFIO zPCI device or equivalent VM-management access, but the vulnerable ioctl itself does not require a real init-namespace root capability check.\nUI:N - After the attacker can issue the relevant KVM/VFIO operations or trigger adapter events for the assigned device, exploitation does not require a separate victim user action.\nS:C - This is KVM host-side memory corruption in a virtualization/device-assignment path, so a plausible exploit crosses the VM or assigned-device security boundary into host kernel resources.\nC:H - The bug performs out-of-bounds reads from page-allocator memory through the misindexed GAIT entry and can expose host kernel memory contents or pointers.\nI:H - The registration and deregistration paths perform out-of-bounds writes to fields including `gisa`, `gisc`, `count`, `aisbo`, and `aisb`, making host kernel memory corruption and potential code execution defensible.\nA:H - The same out-of-bounds reads and writes can corrupt arbitrary adjacent kernel memory or dereference corrupted physical addresses, making host crash or panic a high-probability impact."
    }
  }
}