CVE-2026-52968

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem, specifically affecting s390 PCI devices. This vulnerability arises from incorrect pointer arithmetic during the indexing of the Guest Access Instruction Table (GAIT), leading to out-of-bounds memory access. A local attacker or a malicious guest operating system could exploit this to read or write data beyond allocated memory boundaries, potentially causing system instability or a denial of service.

This flaw is rated as Moderate impact for Red Hat Enterprise Linux because exploitation is confined to the s390x architecture and requires an environment running KVM virtualization with PCI device pass-through or asynchronous interrupt forwarding configured. A malicious guest or local privileged actor could trigger this out-of-bounds memory access to cause host kernel instability or a denial of service. Deployments on non-s390x hardware architectures or systems not running KVM guests with PCI devices are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.