A null pointer dereference was discovered in the Linux kernel’s KVM implementation for the s390 architecture. The function airq_iv_create() can return NULL when it fails to allocate an AIBV, but this return value is not checked. Subsequent code attempts to dereference the null pointer in kvm_zpci_set_airq(), causing the kernel to panic. The resulting crash brings the host down, effectively denying services that depend on the KVM subsystem.

All Linux kernel releases that include KVM s390 PCI support and lack the commit adding the null‑check are affected. This encompasses any distribution that ships an older kernel where the flaw has not been patched. The vulnerability is confined to the s390 architecture and does not impact other architectures or non‑KVM kernel code.

The CVSS score of 9.3 indicates critical severity. The EPSS score is reported as <1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploitation activity to date. The flaw only triggers when airq_iv_create() fails and the null pointer is dereferenced; the exact conditions that produce this failure are not detailed in the advisory.