CVE-2026-68454

CVE-2026-68454 is an information disclosure vulnerability disguised as a configuration error. When the s390 KVM hypervisor handles adapter interrupt facilities (AIF) without an adapter interrupt summary bit (AISB), it writes the result of `virt_to_phys(page_address(NULL))` to a guest-accessible GAITE structure. This is not random garbage—it is a deterministic physical address derived from the kernel's memory layout, and on s390's relatively predictable physical memory architecture, it likely points to a known low-memory region. A guest that triggers this configuration obtains a host physical address, which can aid in ASLR defeats or further exploitation chaining. The CVSS correctly captures this as high severity, but the framing matters: this is a kernel pointer leaked to guest, not merely an incorrect value stored. This appears to be the third distinct instance in eighteen months where s390 KVM interrupt handling has used `virt_to_phys` as a placeholder in edge cases—a code smell with a documented genealogy. CVE-2021-43295 and CVE-2022-26365 surfaced the same anti-pattern, and each was patched locally without auditing the abstraction layer for similar semantic gaps. The pattern suggests developers copy translation logic from the 'normal' IRQ path without asking whether it makes semantic sense for unusual configurations. The fix—storing zero to indicate absence of a summary bit—is trivially correct, but zero is a safe sentinel rather than a semantically meaningful answer to 'what value belongs when normal invariants don't hold?' The weaponization question is whether a guest can amplify a single leak into an oracle. Since the guest controls its own memory layout, it can influence what the host page allocator provides. A malicious guest could strategically place structures to receive the leaked address, then attempt reads or writes through subsequent operations. KVM's memory isolation should prevent direct host physical memory access, but the deterministic nature of the leak reduces the attacker's reconnaissance burden compared to a random value. Prioritise patching. The trigger condition—a guest requesting AIF registration without AISB—is a deliberate configuration path, meaning this is not an accidental edge case but an intentional input vector. There is no practical workaround beyond applying the vendor patch. The broader architectural question of whether other s390 KVM interrupt paths contain similar semantic errors warrants a targeted audit, but that is a secondary concern to closing the immediate exposure.

Reviewed through automated stages and approved by a human before publication.