Description

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled The MPCIFC instruction doesn't allow registering adapter interrupts without first unregistering. So reject any request to enable interrupt forwarding if its already enabled for the zPCI device. This also fixes overwriting and thus leaking resources when the ioctl is called multiple times for the same device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:56.630Z",
  "pubdate": "2026-08-15T13:17:56.630Z",
  "executiveSummary": "A resource management vulnerability exists within the Linux kernel KVM subsystem for the s390 architecture, specifically related to PCI adapter interrupt forwarding handling. The vulnerability arises from the failure to properly validate the existing state of adapter interrupt registration during the execution of the MPCIFC instruction handling via IOCTL requests. An authenticated local user or process with access to the KVM interface can repeatedly issue specific IOCTL commands to enable interrupt forwarding for an already enabled zPCI device. This leads to the overwriting of internal kernel data structures and subsequent resource leaks within the host operating system. The primary impact of this flaw includes kernel memory leaks, potential denial of service through resource exhaustion, and undefined hardware state synchronization issues. Exploitation of this vulnerability requires local execution privileges and access to a virtualized zPCI device managed by KVM on s390 systems. Risk implications are moderate, centering on host-level resource degradation and state corruption rather than direct remote code execution.",
  "technicalDetails": "The vulnerability resides in the Linux kernel KVM s390 PCI driver component, specifically in the logic handling the Modify PCI Function Controls (MPCIFC) instruction. The underlying architectural specification of the MPCIFC instruction strictly prohibits the registration of adapter interrupts without first explicitly unregistering the existing configuration. Prior to the fix, the kernel implementation failed to enforce this architectural constraint within the IOCTL path responsible for enabling adapter interrupt forwarding.\nWhen an attacker or userspace application repeatedly invokes the affected IOCTL to enable adapter interrupt forwarding on a zPCI device that already has forwarding enabled, the kernel blindly re-initializes and overwrites the active registration structures. This overwriting operation abandons references to previously allocated kernel resources without performing proper cleanup or deallocation, resulting in a persistent kernel memory leak. Furthermore, state desynchronization occurs between the host KVM hypervisor tracking mechanisms and the actual hardware or emulated zPCI device configuration.\nTo exploit this vulnerability, an attacker must possess local access to the guest or host system with sufficient privileges to interact with the KVM subsystem and control a zPCI device. The attack flow involves opening the relevant device nodes, configuring a zPCI device, and issuing a sequence of IOCTL calls designed to repeatedly trigger the redundant enablement of adapter interrupts. Because the kernel fails to reject requests when forwarding is already active, the vulnerable code path executes repeatedly, continuously leaking kernel memory structures upon each iteration. While this does not directly yield arbitrary code execution in the kernel, sustained exploitation can exhaust host kernel memory pools, leading to system instability, unresponsiveness, or a complete denial of service for the virtualization host."
}