CVE-2026-68454: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68454 is a NULL pointer dereference vulnerability in the Linux kernel's KVM subsystem for s390 PCI, specifically in the handling of Adapter Interrupt Forwarding (AIF) enablement without an Adapter Interrupt Summary Bit (AISB). When a guest virtual machine registers IRQs without specifying a summary bit, the kernel incorrectly stores a physical address derived from a NULL pointer (virt_to_phys(page_address(NULL))) in the Guest Adapter Interrupt Table Entry (GAITE) instead of storing 0, leading to memory corruption. The vulnerability affects Linux kernel versions from 6.0 onward, with fixes backported to stable branches. It was disclosed on August 13, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In the KVM s390 PCI subsystem, when a guest requests IRQ registration without specifying an AISB, the code path calls virt_to_phys(page_address(NULL)) and writes the resulting non-zero physical address into the GAITE's guest AISB location, rather than correctly storing 0. This incorrect physical address can corrupt kernel memory structures. The attack vector is local, requiring low privileges (guest VM IRQ registration permissions), with no user interaction needed and a changed scope, indicating the impact crosses the guest/host boundary (GitHub Advisory, Red Hat).

Successful exploitation can result in kernel memory corruption on the host system, potentially enabling a guest VM to achieve code execution on the host or cause a system crash (denial of service). The changed scope in the CVSS vector indicates that a compromised guest could affect the host hypervisor, with high confidentiality, integrity, and availability impacts. This represents a guest-to-host escape scenario on IBM s390 (IBM Z) systems running KVM with PCI passthrough and AIF enabled (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with guest VM permissions to perform IRQ registration operations on an s390 KVM host with PCI and AIF configured, significantly limiting the attack surface.

Patches have been backported to multiple stable Linux kernel branches. Fixed versions include 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc4. Administrators should update to the patched kernel version appropriate for their distribution. As a temporary workaround where immediate patching is not possible, restricting guest VM permissions for IRQ registration on s390 KVM hosts with PCI passthrough can reduce exposure. Red Hat has issued a tracking bug for affected RHEL systems (Red Hat, GitHub Advisory).