CVE-2023-52597

What it actually does

Race condition during temporary FPC register load in kvm_arch_vcpu_ioctl_set_fpu allows interrupt context to save/restore host FPC incorrectly, leaving host process with guest-intended value.

Why it matters to the business

On s390 KVM hosts, processes may silently run with corrupted floating-point state, risking instability, incorrect computations, or crashes in virtualized workloads; low EPSS and no KEV status indicate limited real-world urgency despite 954 days since publication.

How an attack unfolds

Attacker invokes the set_fpu ioctl to load a value into the guest FPC; an interrupt fires during the temporary host register load, save_fpu_regs captures the guest value for the host context, and test_fp_ctl restoration is discarded on return to userspace, leaving the host with the wrong FPC.

How to fix it

Apply the upstream fix that removes the temporary test (relying on the later SIE-entry check) or update affected packages to the listed fixed commit 064bac1c7c4d2b90745bf225c92e74d83edb7a4d; note behavior change where invalid FPC values are now accepted rather than rejected with -EINVAL.

How to confirm the fix worked

Confirm kernel contains the removal of the fpc test in kvm_arch_vcpu_ioctl_set_fpu; verify that invalid FPC values no longer cause ioctl failure and that host FPC is not altered after guest set operations.

Typical attack path

1. Obtain capability to issue KVM s390 VCPU ioctls
2. Call kvm_arch_vcpu_ioctl_set_fpu with chosen FPC value
3. Force or wait for interrupt while value is live in host FPC
4. Trigger fp/vx usage in interrupt handler to expose corruption
5. Observe or abuse resulting host-process FPC state

How to detect it

Review kernel logs for KVM s390 FPC-related warnings or register-state anomalies; inspect host processes for unexpected FPC values after guest ioctl activity; correlate with interrupt-heavy workloads on s390 KVM.

What your security team should do

• Patch s390 KVM hosts to the fixed commit or equivalent mainline change
• Audit any remaining use of the legacy set_fpu ioctl path
• Restrict untrusted access to KVM device ioctls
• Monitor EPSS trend (stable at 0.0023) for any future increase