Linux Kernel CVE-2026-68454

Exploitation requires all of the following concurrently: (1) the target host must run a Linux kernel on s390 (IBM Z) architecture with KVM hypervisor support compiled in (CONFIG_KVM_S390); (2) the host must have PCI hardware with Adapter Interrupt Forwarding (AIF) capability enabled and exposed to at least one guest VM; (3) the attacker must have low-privileged code execution inside a KVM guest on that host; and (4) the guest must be permitted to invoke IRQ registration via the AIF interface without specifying an AISB. Exploitation is strictly limited to s390/KVM/PCI-AIF systems - x86, ARM, RISC-V, and all other architectures are not affected by this code path. Guests without PCI device passthrough or without AIF support in their configuration cannot trigger the vulnerable code path. The required hardware (IBM Z mainframe or LinuxONE) and software stack (KVM with s390 PCI/AIF) significantly limits the realistic attacker population compared to a typical Linux CVE.

The CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is the dominant risk signal, and the scope change (S:C) is the most important metric: it signals a guest-to-hypervisor trust boundary crossing, which is the core security guarantee of a Type-1 hypervisor. Low attack complexity (AC:L) and low privilege (PR:L) suggest that once inside a guest VM, triggering the bug is straightforward. However, real-world exposure is sharply constrained by the platform specificity - this affects only the intersection of IBM Z hardware, Linux KVM, PCI with AIF capability, and guest-initiated IRQ registration without AISB, meaning even a mid-sized municipal IT team in rybnik would only be exposed if operating IBM Z mainframes running KVM with PCI device passthrough and AIF enabled, a specialized combination found primarily in large financial institutions and telcos. No EPSS score was present in the input data, and neither a public proof-of-concept nor a CISA KEV entry has been identified, indicating no confirmed widespread exploitation. The high C:H/I:H/A:H impact trio is plausible for a VM escape class bug but has not been independently validated through a published exploit demonstration. CVSS likely accurately characterizes the worst-case potential; actual exploitation difficulty in practice is higher than AC:L implies once platform prerequisites are accounted for.

An attacker with low-privileged shell access inside a KVM guest VM on an s390 host with PCI/AIF hardware registers an IRQ handler via the AIF interface, deliberately omitting the Adapter Interrupt Summary Bit specification. The kernel writes virt_to_phys(page_address(NULL)) - an incorrect host physical address - into the GAITE rather than zero, corrupting the hypervisor's interrupt forwarding table. The attacker then leverages subsequent PCI interrupt activity to access or corrupt host physical memory through the poisoned GAITE entry, potentially achieving hypervisor escape. No public proof-of-concept has been identified at time of analysis.