KVM NULL Dereference Vulnerability in Linux Kernel Affecting IBM Systems

CVE-2026-80684

What is CVE-2026-80684?

In the Linux kernel, a potential NULL dereference vulnerability has been identified in the KVM module specifically affecting IBM systems. The issue occurs within the airq_iv_create() function, which can return NULL upon allocation failure. This scenario is not appropriately handled, leading to potential system errors when later attempting to use the NULL value in the kvm_zpci_set_airq() function. To mitigate this risk, a NULL check has been implemented along with proper memory management for previously allocated resources, ensuring system stability and security.

References