CVE-2023-52597 is a vulnerability identified in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for the s390 architecture, which is IBM's mainframe platform. The vulnerability arises in the function kvm_arch_vcpu_ioctl_set_fpu(), which is responsible for setting the floating point control (fpc) register of a guest virtual CPU. The function attempts to validate the new fpc value by temporarily loading it into the fpc register. However, if an interrupt occurs during this temporary loading and floating point or vector registers are used within the interrupt context, the host process's fpc register can become corrupted. This happens because the current floating point/vector registers are saved assuming they belong to user space and will be restored accordingly, but the test_fp_ctl() function that restores the original fpc register value discards this restoration upon returning to user space. Consequently, the host process continues running with the guest CPU's fpc register value, which is incorrect and can lead to integrity and availability issues. The fix implemented removes the temporary loading test, relying instead on another validation step before entering the SIE context, which handles invalid values. This change means invalid fpc values are now accepted rather than causing the ioctl call to fail, aligning with behavior in the memory-mapped interface where invalid values are replaced with zero. The vulnerability has a CVSS v3.1 score of 4.0 (medium severity), with an attack vector of local (AV:L), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and low availability impact (A:L). There are no known exploits in the wild, and the affected versions correspond to specific Linux kernel commits. This vulnerability is specific to the s390 KVM subsystem and does not affect other architectures or general Linux kernel usage.

For European organizations running Linux on IBM mainframe hardware (s390 architecture) with KVM virtualization enabled, this vulnerability could lead to corruption of the host process's floating point control register. Although the impact on confidentiality is negligible, the integrity and availability of host processes could be compromised, potentially causing unpredictable behavior or crashes in critical virtualized environments. This is particularly relevant for enterprises relying on mainframe virtualization for critical workloads such as banking, government, and large-scale enterprise resource planning (ERP) systems. The medium severity rating reflects the limited attack vector (local access required) and high complexity, reducing the likelihood of exploitation. However, the potential for subtle corruption in host processes could lead to difficult-to-diagnose failures or data integrity issues in virtualized guest environments. Since no known exploits exist in the wild, the immediate risk is low, but organizations should prioritize patching to prevent future exploitation, especially those with compliance requirements or high availability needs.

1. Apply the official Linux kernel patches that address CVE-2023-52597 as soon as they become available from trusted Linux distribution vendors or the Linux kernel mainline. 2. For organizations using s390 KVM virtualization, review and restrict local access to systems to trusted administrators only, minimizing the risk of local exploitation. 3. Monitor system logs and kernel messages for unusual floating point or vector register errors or crashes that could indicate exploitation attempts or instability. 4. Implement strict access controls and auditing on virtualization management interfaces to detect and prevent unauthorized ioctl calls that could trigger this vulnerability. 5. Consider isolating critical virtual machines and host processes to reduce the blast radius in case of exploitation. 6. Coordinate with hardware and software vendors to ensure firmware and hypervisor components are up to date and compatible with patched kernels. 7. Conduct thorough testing of patched kernels in staging environments to verify stability and compatibility before deployment in production.