CVE-2023-54092

What it actually does

Incorrect index value in the struct page for a guest ASCE during s390_replace_asce allows wrong addresses to be passed to PTE invalidation notifiers, resulting in validity intercepts when the prefix page is unmapped.

Why it matters to the business

Unexpected crashes of s390 KVM virtual machines can cause operational downtime and service interruptions for workloads running on affected Linux kernels.

How an attack unfolds

An attacker or faulty guest configuration triggers ASCE replacement without resetting the page index to zero; subsequent unmapping of the prefix page causes the notifier to receive an invalid address and induce a validity intercept that crashes the VM.

How to fix it

Upgrade the Linux kernel to version 5.10.190 or apply commit 8e635da0e0d3cb45e32fa79b36218fb98281bc10 (or equivalent backports) in all affected stable trees; reboot hosts after installation.

How to confirm the fix worked

Confirm the running kernel version is 5.10.190 or newer; inspect the s390_replace_asce function to verify the index is explicitly set to zero on the new ASCE page.

Typical attack path

1. Gain ability to influence ASCE replacement in a KVM s390 protected-virtualization guest
2. Force or wait for prefix page unmapping
3. Trigger PTE invalidation notifier with incorrect address derived from non-zero index
4. Cause validity intercept resulting in guest VM termination

How to detect it

Review hypervisor and guest logs for validity intercepts or unexpected KVM s390 guest terminations; correlate with ASCE replacement events if extended tracing is enabled.

What your security team should do

• Prioritize kernel updates on all s390 KVM hosts within standard change windows
• Test the fixed kernel in a non-production s390 environment before broad deployment
• Monitor VM stability metrics on s390 systems until patches are applied