Linux Kernel EUVD-2026-57923

The vulnerability is in the Linux kernel's KVM subsystem for s390 (IBM Z) architecture, specifically the PCI Adapter Interrupt Forwarding (AIF) path in arch/s390/kvm/pci.c. AIF is an IBM Z hardware mechanism allowing guest VMs to receive PCI adapter interrupts directly, bypassing the hypervisor for performance. The Guest Adapter Interrupt Table Entry (GAITE) stores the physical address of the guest's Adapter Interrupt Summary Bit (AISB) page, which the hardware uses to signal pending interrupts. The defect: when a guest registers IRQs via the AIF interface without specifying an AISB, the code path should store 0 in the GAITE's AISB address field to indicate the feature is unused. Instead, it evaluates virt_to_phys(page_address(NULL)), which computes the physical address mapped from the NULL virtual address - on s390, this may yield a non-zero physical address corresponding to the zero page, producing an invalid, hardware-consumed GAITE entry that points into real host physical memory. The CPE string cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* applies scoped to s390 KVM with CONFIG_KVM and PCI/AIF support. No CWE is formally assigned by NVD, but the root cause class is closest to CWE-824 (Access of Uninitialized Pointer) or CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), arising from incorrect null handling in a physical address computation.