Description

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest seeks to register IRQs without a summary bit specified, ensure that the associated GAITE then stores 0 for the guest AISB location instead of virt_to_phys(page_address(NULL)).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T15:19:58.210Z",
  "pubdate": "2026-08-13T15:19:58.210Z",
  "executiveSummary": "A vulnerability has been identified in the Linux kernel's KVM subsystem specifically affecting the s390 architecture regarding PCI Adapter Interruption Facility (AIF) handling.\nThe vulnerability type is improper initialization/handling of Guest Adapter Interruption Translation Entries (GAITE), leading to a potential memory corruption or null pointer dereference scenario.\nThe impact includes potential denial of service or unauthorized memory access within the hypervisor context when a guest registers interrupts without a designated summary bit.\nAffected systems comprise Linux kernel installations utilizing KVM virtualization on the s390 architecture.\nThe risk implications involve destabilization of the host kernel through improper physical address translation.\nAttacker capabilities require the ability to configure guest PCI devices and register IRQs within a virtual machine to trigger the vulnerable code path.\nExploitation requirements include administrative privileges inside the guest context to perform specific PCI IRQ registration hypercalls.",
  "technicalDetails": "The vulnerable component resides in the Linux kernel KVM implementation for s390 PCI virtualization, specifically within the handling of Adapter Interruption Facility (AIF) enable routines without Adapter Interruption Summary Bit (AISB) configuration.\nThe root cause stems from the application attempting to derive a physical address for a guest AISB location using virt_to_phys(page_address(NULL)) when no summary bit is explicitly specified by the guest during IRQ registration.\nThis operation evaluates to a physical address translation of a null pointer, yielding an incorrect memory reference rather than storing a safe default value of 0 in the associated Guest Adapter Interruption Translation Entry (GAITE).\nDuring the attack flow, a malicious or improperly configured guest issues a request to register IRQs without a summary bit.\nThe KVM subsystem processes this request and populates the GAITE structure incorrectly due to the absence of input validation or fallback handling for the missing AISB address.\nInstead of storing 0 to represent the null or unused AISB location, the system writes the evaluated physical address of page zero into the translation entry.\nSubsequent hardware or hypervisor processing utilizing this corrupted GAITE can result in unexpected memory mapping behaviors, potential fault conditions, kernel panics, or denial of service affecting the host system.\nPrivilege requirements involve local guest administrative access capable of interacting with virtualized PCI infrastructure.\nThe vulnerability does not inherently require network exposure, as the attack vector is triggered via local hypercalls from the virtual machine to the host hypervisor."
}