The vulnerability (CVE-2026-80921) affects the Linux kernel's KVM s390 vsie implementation. When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), bits 64 through 255 were not cleared and remained as stale data from the vsie page in the crycb and apcb. This flaw could allow a nested guest virtual machine to gain unauthorized access to a device that should have been inaccessible. The fix involves zeroing out these remaining bits to prevent such unauthorized access.

Exploitation of this vulnerability could allow a nested guest virtual machine to access devices that are no longer available, potentially leading to a complete compromise of confidentiality, integrity, and availability within the affected virtualized environment. The CVSS 3.1 score of 8.8 reflects the high impact across these security properties with low attack complexity and privileges required.

A fix has been implemented in the Linux kernel to zero out the stale crypto bits, resolving the vulnerability. Users and administrators should apply the official Linux kernel updates that include this patch. Since no explicit patch links or vendor advisories are provided here, verify and obtain the fix from the official Linux kernel sources or trusted vendor updates. There is no indication of known exploits in the wild at this time.