CVE-2026-68454

A flaw was found in the KVM (Kernel-based Virtual Machine) subsystem of the Linux kernel, affecting the s390 PCI implementation. When a guest operating system registers interrupt requests (IRQs) without a specific summary bit, the system incorrectly stores an invalid memory address. This improper handling of memory addresses can lead to system instability, potentially resulting in a denial of service for the host system.

This vulnerability is rated as Moderate because exploitation is restricted to IBM Z (s390x) environments hosting KVM virtual machines with PCI device passthrough, requiring access from within an active guest. Deployments on other hardware architectures or s390x systems not utilizing KVM virtualization are unaffected. While a guest triggering this condition can induce a host kernel crash resulting in a denial of service, the flaw does not facilitate arbitrary code execution or data leakage across guest boundaries.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.