CVE-2026-68454

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable code is reached through the KVM_S390_ZPCI_OP VM ioctl, issued by the userspace VMM on behalf of a guest executing the mpcifc "register adapter interrupts" instruction for an assigned zPCI device; no network path exists.

AC:LAttack complexity, low

The guest simply registers adapter-event notification with no summary bit (sb == 0), which deterministically stores virt_to_phys(page_address(NULL)) into the GAITE; the subsequent wild access is then triggered at will by device interrupt activity or by deregistering/tearing down the VM.

PR:LPrivileges required, low

The attacker needs access to a KVM VM file descriptor with an assigned zPCI device, i.e. control of a guest kernel or of the unprivileged QEMU process; no host root or init-namespace privilege is required.

UI:NUser interaction, none

The guest triggers the register/deregister sequence entirely on its own; no host administrator or other user action is needed.

S:CScope, changed

A guest action corrupts host kernel state outside the VM's security authority — the GAITE is host-owned and the resulting wild accesses occur in host kernel context, crossing the guest/hypervisor boundary.

C:HConfidentiality impact, high

kvm_s390_pci_aif_disable() turns the bogus physical address into a struct page via phys_to_page() and reads folio metadata from it, an out-of-bounds vmemmap read; the resulting refcount underflow can free memory still in use, yielding a read primitive over host memory belonging to the hypervisor and other guests.

I:HIntegrity impact, high

aen_host_forward() performs set_bit_inv() on phys_to_virt(garbage) — an atomic OR write at a wild host kernel address — and unpin_user_page() decrements the refcount of a fabricated struct page, giving host memory corruption and a premature-free primitive usable for control-flow hijack.

A:HAvailability impact, high

The wild atomic write in hard-IRQ context and the bogus struct page dereference reliably produce an addressing exception / kernel panic in the host, taking down the hypervisor and every guest on it.