A vulnerability in the Linux kernel KVM s390 subsystem allows a local attacker to trigger a conflict in interrupt forwarding, leading to potential privilege escalation or system disruption.

The MPCIFC instruction fails to reject adapter interrupt forwarding requests if they are already enabled, leading to an inconsistent state. This requires local, authenticated access to the system.

While the attack vector requires local access, the high CVSS score of 8.8 reflects the severity of a potential guest-to-host breakout or complete system compromise. This is particularly concerning for multi-tenant environments relying on KVM virtualization on s390 hardware.

Immediate Action: Update the Linux kernel to the versions containing the upstream fix, specifically 6.6.151, 6.12.103, 6.18.44, or 7.1.8.

Proactive Monitoring: Monitor KVM logs for unusual PCI or interrupt-related errors within virtualized environments.

Compensating Controls: Ensure strict access control to virtual machine management interfaces to prevent unauthorized local user access.

Public Exploit Available: No

Organizations utilizing KVM on s390 architecture must prioritize this update to prevent unauthorized access or system instability. Apply the recommended kernel patches as part of the next scheduled maintenance window or sooner for high-security environments.