CVE-2026-68454
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, in the KVM subsystem for s390 PCI handling, a bug was found: when a guest registers IRQs without a summary bit, the associated GAITE entry stores an incorrect value (physical address instead of zero) in the guest AISB location. The fix ensures zero is stored there.
Risk Assessment
Incorrect interrupt handling may lead to errors in communication with PCI devices in virtualized environments, potentially causing crashes or unpredictable guest system behavior.
Recommendation
Apply the fix from a newer Linux kernel version as soon as possible, and monitor security updates for your distribution.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest seeks to register IRQs without a summary bit specified, ensure that the associated GAITE then stores 0 for the guest AISB location instead of virt_to_phys(page_address(NULL)).