CVE-2026-74515KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled The MPCIFC instruction doesn't allow registering adapter interrupts without first unregistering. So reject any request to enable interrupt forwarding if its already enabled for the zPCI device. This also fixes overwriting and thus leaking resources when the ioctl is called multiple times for the same device.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc before 642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70; from 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc before 78d9648e7e960546d5b72504a0b0358cd8bb1e9d; from 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc before 6be1ff49ba81f96a6fa55915e6d920be43ac57cc; from 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc before 6837f0ae85fd54cf64c8a0c7c530bba2fae0a207; from 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc before 591952b63a9f976da7d49f719f36ec826ee2a575; from 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc before 8fa01be5a6149404adb82c0979a78f6347edd3ef | CNA record |
References
- https://git.kernel.org/stable/c/642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70
- https://git.kernel.org/stable/c/78d9648e7e960546d5b72504a0b0358cd8bb1e9d
- https://git.kernel.org/stable/c/6be1ff49ba81f96a6fa55915e6d920be43ac57cc
- https://git.kernel.org/stable/c/6837f0ae85fd54cf64c8a0c7c530bba2fae0a207
- https://git.kernel.org/stable/c/591952b63a9f976da7d49f719f36ec826ee2a575
- https://git.kernel.org/stable/c/8fa01be5a6149404adb82c0979a78f6347edd3ef
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.