8.8

CVE-2026-52968: KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

Modified
AliasesUBUNTU-CVE-2026-52968DEBIAN-CVE-2026-52968
Published 24-06-2026Last modified 19-10-2026

Vulnerability summary

CVE-2026-52968 is a high (CVSS 8.8) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.1% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 8.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.18%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 26 · Related 26
SUSE-SU-2026:5091-1USN-8566-1USN-8567-1USN-8568-1USN-8569-1USN-8574-1

Timeline

  1. 24-06-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() index the GAIT by manually multiplying the index with sizeof(struct zpci_gaite). Since aift->gait is already a struct zpci_gaite pointer, this double-scales the offset, accessing element aisb*16 instead of aisb. This causes out-of-bounds accesses when aisb >= 32 (with ZPCI_NR_DEVICES=512) Fix by removing the erroneous sizeof multiplication.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.18% on 06-10-2026

06-10-202605-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu154 products
  • linuxAll versions (No fix recorded) | < 6.8.0-136.136 | < 7.0.0-28.28
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1061.64 | < 7.0.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 73f91b004321f2510fa79e66035dbbf1870fcf56, < 31a9d9f9942885aae356a1a57c79e82c5b5b0828 | ≥ 73f91b004321f2510fa79e66035dbbf1870fcf56, < a99a25db131ece5e6c0f7632da606de631efe4f2 | ≥ 73f91b004321f2510fa79e66035dbbf1870fcf56, < 11b8ff5b930b351dd1f6f088dce0beb027ac92d0 | ≥ 73f91b004321f2510fa79e66035dbbf1870fcf56, < b22a2da8792a7bfe743c1a922e77fa499ddedbe8 | ≥ 73f91b004321f2510fa79e66035dbbf1870fcf56, < e7216651b94e92e5433fb2f54b77864642b4ea48 | ≥ 73f91b004321f2510fa79e66035dbbf1870fcf56, < 16d990a15491cf76cd6eef0846e1b4100e63261a | 6.0
  • linux_kernel≥ 6.0, < 6.1.175 | ≥ 6.2, < 6.6.141 | ≥ 6.7, < 6.12.91 | ≥ 6.13, < 6.18.33 | ≥ 6.19, < 7.0.10 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3
Debian1 product
  • linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.10-1

3 vendors · 157 products

References

36 links
Show all 36 references