CVE-2026-80921: Linux

High severity, CVSS 8.8. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.

Affected products

• Linux Linux: from 4.20, before 5.10.269 (fixed in 5.10.269); from 5.11, before 5.15.220 (fixed in 5.15.220); from 5.16, before 6.1.187 (fixed in 6.1.187); from 6.2, before 6.6.156 (fixed in 6.6.156); from 6.7, before 6.12.108 (fixed in 6.12.108); from 6.13, before 6.18.49 (fixed in 6.18.49); …

Published 2026-09-09. Last modified 2026-09-10.