The Linux kernel KVM implementation for the s390 architecture fails to validate the size of the AIBV bit vector and the alignment of the AISB address before pinning guest pages. Because the kernel does not check whether the AIBV exceeds a single page boundary or whether the AISB address is 8‑byte aligned, it could attempt to pin memory outside the intended region, creating an opportunity for kernel memory corruption.

The flaw affects any Linux kernel that implements KVM on the s390 architecture and has not yet applied the patch referenced in this advisory. No specific kernel releases are listed, so every release prior to the fix is considered vulnerable.

No CVSS or EPSS score is provided, and the vulnerability is not listed in CISA KEV. The conditions that trigger the bug require an MSI‑X configuration with an AIBV larger than one page or an AISB that is not 8‑byte aligned, which normally would cause the kernel to reject the request once the check is in place. Prior to the patch, the lack of validation could have allowed a guest VM to craft a request that forces the host to pin memory incorrectly, potentially corrupting kernel data structures. Exploitation is local to the host and depends on the guest’s ability to influence the MSI‑X configuration, so the overall likelihood is moderate but not negligible.