CVE-2026-52968

What it actually does

This is an out-of-bounds memory access flaw in the Linux kernel KVM implementation for s390/s390x PCI interrupt handling. The affected code indexes the GAIT table incorrectly because pointer arithmetic is scaled twice: the code manually multiplies an index by the size of the GAIT entry even though the pointer type already applies that scaling. When an adapter interrupt summary bit index is 32 or higher, the kernel can read from or write to memory beyond the intended GAIT table entry. Depending on kernel configuration, memory layout, and runtime conditions, this may cause kernel memory corruption, a host kernel crash, or potentially unintended manipulation of adjacent kernel memory associated with KVM/zPCI state.

Why it matters to the business

Organizations running Linux KVM virtualization on IBM Z or LinuxONE systems with s390 PCI passthrough or adapter interrupt forwarding could experience host instability or denial of service affecting hosted workloads. Because the issue is in kernel virtualization code, a successful trigger could disrupt multiple virtual machines on the same host. Current public exploitation signals are low: EPSS is 0.00139, it is not listed in CISA KEV, it is not known to be used in ransomware campaigns, and no public exploit maturity is reported. However, kernel-level flaws in virtualization components should still be prioritized for affected platforms because operational impact can be high even when exploitation likelihood is currently low.

How an attack unfolds

An attacker would need access to a KVM guest or management path capable of influencing s390 zPCI adapter interrupt forwarding state. The attacker attempts to drive KVM code paths that enable, disable, or forward adapter interrupts using an adapter interrupt summary bit index of 32 or greater. Due to the double-scaled pointer arithmetic, the host kernel calculates an address beyond the intended GAIT table element and accesses the wrong memory. The most likely observable outcome is a host kernel warning, oops, panic, or KVM/zPCI malfunction. In a more favorable memory layout, the out-of-bounds access could corrupt adjacent kernel data, though no public exploit is currently known.

How to fix it

Apply a Linux kernel update that includes the upstream fix removing the erroneous sizeof(struct zpci_gaite) multiplication from the KVM s390 PCI GAIT indexing logic. Because no product-specific fixed versions were provided, use the latest vendor-supported kernel for the affected distribution or platform and confirm the vendor advisory explicitly includes the fix for this issue. Prioritize patching s390/s390x KVM hosts that use PCI passthrough, zPCI, or adapter interrupt forwarding. If immediate patching is not possible, reduce exposure by disabling or avoiding zPCI passthrough and adapter interrupt forwarding features where operationally feasible, restricting guest administration privileges, limiting VM creation and device assignment permissions, and increasing monitoring for host kernel faults.

How to confirm the fix worked

Confirm whether the host is an s390/s390x KVM system and whether zPCI or PCI passthrough features are in use. Validate remediation by checking the installed kernel package version against the relevant Linux distribution or hardware vendor advisory, or by verifying that the source/build includes the corrected GAIT indexing logic without manual sizeof(struct zpci_gaite) scaling. After patching, reboot into the fixed kernel and confirm the running kernel version, not only the installed package version. Review kernel logs before and after patching for KVM, s390, zPCI, GAIT, KASAN, oops, or panic messages. Where a staging environment is available, exercise normal VM lifecycle and PCI passthrough operations to confirm that KVM/zPCI functionality remains stable after the update.

Typical attack path

1. Gain access to a guest VM or management capability on an affected s390/s390x KVM host using zPCI functionality.
2. Configure or trigger PCI adapter interrupt forwarding behavior that reaches the affected KVM s390 zPCI code paths.
3. Cause the adapter interrupt summary bit index to be 32 or higher.
4. Trigger kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), or aen_host_forward().
5. The kernel calculates an incorrect GAIT table offset and accesses memory outside the intended table entry.
6. The host may experience KVM/zPCI malfunction, kernel memory corruption, oops, panic, or service disruption.

How to detect it

Detection should focus on signs of attempted triggering or successful faulting of the affected KVM s390 PCI code paths. Collect and review kernel logs from journald, syslog, dmesg, kdump/vmcore analysis, hypervisor management logs, and any centralized EDR or SIEM telemetry from virtualization hosts. Look for kernel oops, panic, KASAN, KFENCE, general protection fault, or slab out-of-bounds messages occurring on s390/s390x KVM hosts, especially around PCI passthrough, zPCI adapter interrupt setup, guest device assignment, VM start/stop, or interrupt-forwarding activity. Useful forensic artifacts include /var/log/kern.log, /var/log/messages, journalctl -k output, dmesg output, crash dumps under /var/crash or distribution-specific kdump directories, and libvirt/QEMU logs that show recent guest lifecycle or PCI device assignment events before the kernel fault. There are no known public threat actors or ransomware campaigns associated with this issue, so detection should emphasize anomalous host crashes and memory-corruption signatures rather than known malware indicators.

• kvm_s390_pci_aif_enable
• kvm_s390_pci_aif_disable
• aen_host_forward
• BUG: KASAN: slab-out-of-bounds
• BUG: KASAN: out-of-bounds
• KFENCE: out-of-bounds
• general protection fault
• kernel BUG at
• Oops:
• Kernel panic - not syncing
• Call Trace:
• KVM: s390
• zpci
• GAIT
• /var/log/kern.log
• /var/log/messages
• /var/crash

What your security team should do

• Inventory Linux KVM hosts on s390/s390x architecture and identify those using zPCI, PCI passthrough, or adapter interrupt forwarding.
• Patch affected hosts to a vendor-supported kernel containing the fix; ensure systems are rebooted into the fixed kernel.
• Prioritize externally managed, multi-tenant, or high-consolidation virtualization hosts because a host crash can impact many workloads.
• If patching must be delayed, temporarily disable or restrict zPCI passthrough and limit who can assign PCI devices to guests.
• Review kernel, hypervisor, and system journal logs for crashes or memory-safety warnings involving KVM s390 PCI code.
• Enable centralized collection of kernel logs from virtualization hosts so host-level crashes and oops events are retained after reboot.
• Monitor vendor advisories for backported fixed kernel versions and any change in exploit maturity, KEV status, or threat actor activity.