This vulnerability occurs in the Linux kernel’s KVM for s390 when attempting to enable Asynchronous Interrupts for Frame (AIF). If the setup of guest interrupt forwarding pages or the allocation of associated bits fails, the function kvm_s390_gisc_register() unwinds the allocated pages but fails to unregister the GISC reference it has previously added. The lingering reference count prevents the resource from being released, potentially causing memory exhaustion or a denial of service.

All Linux kernel implementations that use KVM on the s390 architecture with the affected code path are impacted. The specific kernel releases that contain the pre-patch route are not listed in the data, so any kernel version not yet updated to include the commit that adds kvm_s390_gisc_unregister() on error should be treated as vulnerable.

The CVSS score is 5.5, EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. The impact remains a resource exhaustion via reference count leak that could degrade system availability. The likely attack vector is local or requires a privileged user capable of triggering AIF setup failures; no remote code execution or other direct attack paths are described. The moderate CVSS score and low EPSS suggest the risk is moderate, but environments running vulnerable KVM versions could still suffer from repeated failed AIF enable attempts under load.