CVE-2023-54092: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54092 is a Linux kernel vulnerability in the KVM subsystem for s390 (IBM Z) architecture, involving incorrect handling of the index value of a replaced Address Space Control Element (ASCE). Specifically, when s390_replace_asce() replaces a guest ASCE, it fails to set the index field of the corresponding struct page to 0, which can result in wrong addresses being passed during PTE invalidation notifications and ultimately cause VM crashes (validity intercepts). The vulnerability was publicly disclosed on December 24, 2025, and affects Linux kernel versions prior to the patched stable releases. It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is an incorrect initialization of the index field in the struct page associated with a guest ASCE during the s390_replace_asce() function in the KVM s390 protected virtualization (pv) code path. The index field should always be 0 for guest ASCE pages, but the replacement path omits this assignment, leading to stale or incorrect index values. This incorrect index can cause PTE invalidation notifiers to be invoked with wrong guest addresses; if the guest prefix page is unmapped under these conditions, the hypervisor may generate a validity intercept, crashing the guest VM. The attack vector is local, requires low privileges, and has high attack complexity, classifying it under improper initialization (CWE-665) (Red Hat CVE).

Successful exploitation can result in guest VM crashes (availability impact), and potentially incorrect memory address handling that may affect the integrity and confidentiality of guest memory operations on s390 KVM hosts. The primary observable impact is a denial-of-service condition for guest VMs running on affected s390 KVM hypervisors, triggered when the guest prefix is unmapped and the PTE invalidation notifier is called with a wrong address. The scope is limited to the affected host's KVM guests on s390 architecture; lateral movement to other systems is not a direct consequence, but VM crashes could disrupt critical workloads (Red Hat CVE).

Patches have been backported to multiple stable Linux kernel branches: 5.10.190, 5.15.124, 6.1.43, 6.4.8, and 6.5. Administrators running KVM on s390 architecture should update to the appropriate patched kernel version for their distribution. Red Hat has tracked this issue under Bugzilla ID 2425173. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (Red Hat Bugzilla, Red Hat CVE).