KVM s390 zPCI: IRQ registration without a summary bit stored a bogus guest AISB address

Impact

A guest registering adapter-interrupt forwarding without specifying a summary bit caused the GAITE to store virt_to_phys(page_address(NULL)) as the guest AISB location instead of zero, leaving the host's interrupt-forwarding table pointing at an address derived from a NULL page. The flaw is in the host hypervisor and is driven entirely by guest-supplied registration parameters, which is the kind of host-side state corruption a VM should not be able to cause. Scope is narrow for accelerator operators: this is IBM Z zPCI passthrough under KVM on s390, not x86 or Arm GPU hosts, so a conventional GPU datacenter is unaffected unless it runs s390 virtualization alongside.

Who can reach it

A guest running under KVM on s390 that can issue zPCI interrupt registration - local to the host, requires only normal guest privilege inside the VM. Not reachable on non-s390 hosts.

What to do

Take the stable kernel containing the fix (store 0 for the guest AISB when no summary bit is given) and reboot affected s390 KVM hosts after migrating or stopping guests. No runtime mitigation is described in the record.

References

Related entries

• Linux kernel BPF verifier: stale register bounds let an LSM-hook retval load bypass memory-safety checksCVE-2026-72111 · Linux kernel BPF verifier (check_mem_access retval range narrowing)High
• Linux kernel (net/xfrm): The rtnetlink changelink path for xfrm interfaces checked CAP_NET_ADMIN only against theCVE-2026-72136 · Linux kernel (net/xfrm)High
• Linux kernel (arch/x86/kvm): When KVM failed to program the interrupt remapping table for irq bypass, it left aCVE-2026-72283 · Linux kernel (arch/x86/kvm)High
• Linux kernel xen/pvcalls: malicious backend req_id drives an out-of-bounds write in the PV frontendCVE-2026-72380 · Linux kernel xen/pvcalls frontend (unbounded backend req_id indexing rsp[])High
• Linux kernel BPF: conntrack kfuncs write opts->error outside the verifier-checked rangeCVE-2026-72423 · Linux kernel BPF conntrack kfuncs (opts__sz bounds on opts->error)High
• Linux kernel (drivers/iommu): Every peer-to-peer segment in a scatter-gather list inherits the length of the firstCVE-2026-74277 · Linux kernel (drivers/iommu)High