CVE-2026-31568

In the Linux kernel's s390 architecture, a vulnerability exists in the memory management subsystem where secure storage access exceptions occurring on storage donated to the Ultravisor are not properly handled. Pages donated to the Ultravisor lack the PG_arch_1 bit, which normally indicates non-exported guest secure storage. The kernel attempted to handle these exceptions by calling arch_make_folio_accessible(), but since the bit is absent, the function returns immediately without performing any action, leading to an infinite loop of unresolved exceptions [1], [2], [3].

This flaw can be triggered in kernel contexts when the system encounters a secure storage access exception for donated memory. No special privileges are required beyond access to the affected system, but the attack surface relies on conditions that cause such exceptions on pages without PG_arch_1. The vulnerability is local, requiring the ability to induce a secure storage access, possibly through interaction with the Ultravisor.

An attacker able to trigger the vulnerability can cause the kernel to enter an infinite loop, resulting in a system hang and effectively a denial of service (DoS). The CVSS score of 7.1 (High) reflects the availability impact with no confidentiality or integrity compromise.

The vulnerability has been fixed in the Linux kernel stable releases with commits [1], [2], and [3]. Users are advised to update to the latest kernel versions that include these patches.