In the Linux kernel’s KVM implementation for the s390 architecture, the airq_iv_create() function can return NULL when it fails to allocate an AIBV. The code fail‑s to check this return value and proceeds to dereference the null pointer in kvm_zpci_set_airq(), causing a kernel panic. This crash brings the host down and results in a denial‑of‑service.

All Linux kernel releases that include KVM s390 PCI support before the commit that added the null‑check are affected. The flaw is limited to the s390 architecture; other architectures and non‑s390 code are not impacted. The issue is triggered when the AIBV allocation code path is exercised, such as during PCI passthrough or other KVM operations on s390 systems.

The vulnerability is a classic null‑pointer dereference (CWE‑476). No CVSS score is listed, but a kernel panic is considered a high‑severity local vulnerability. There is no EPSS score and the CVE is not in the CISA KEV catalog, indicating no confirmed exploitation activity. The attack vector is local: a privileged user in the KVM environment can induce the allocation failure and force the kernel to panic, denying service to the host.