CVE-2026-80921 KVM: s390: vsie: zero stale crypto bits
A nested guest on s390x KVM can access stale crypto bits, potentially reading data from unavailable devices due to improper memory zeroing.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80921?
CVE-2026-80921 is a high-severity vulnerability in Linux, published on 9 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: vsie: zero stale crypto bits
When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.
Which versions are affected by CVE-2026-80921?
How do I fix CVE-2026-80921?
Apply the vendor's patch.
Is CVE-2026-80921 being exploited?
There is no known exploitation of CVE-2026-80921 in the wild and no public exploit code.
Sources
Also known as AZL-99950, BELL-CVE-2026-80921, DEBIAN-CVE-2026-80921, GHSA-337q-m32v-p95j, UBUNTU-CVE-2026-80921.