Red Hat Patches Kernel Flaw Affecting KVM Interrupt Forwarding on IBM Z Systems
Red Hat has released a Moderate-rated kernel security update for Red Hat Enterprise Linux 8, published as RHSA-2026:89816 on 26 October 2026. The advisory addresses a single flaw, CVE-2026-74515, in the KVM virtualisation code for the s390 architecture, where the PCI subsystem failed to reject a request to enable adapter interrupt forwarding when that forwarding was already enabled. The fixed package is kernel-4.18.0-553.179.1.el8_10, shipped for every mainstream RHEL 8 architecture including x86_64, ppc64le, aarch64 and s390x, as well as the matching CodeReady Linux Builder channels. Extended Life Cycle Support customers running RHEL 8.10 on all four architectures receive the same build. The functional defect itself lives in s390-specific KVM code, so the practical exposure sits with IBM Z and LinuxONE hosts that run virtual machines with zPCI device passthrough, even though the corrected kernel is distributed everywhere.
Red Hat has not published exploitation details for CVE-2026-74515, and the advisory text is limited to the one-line description of the fix: the kernel now rejects a duplicate request to enable adapter interrupt forwarding rather than accepting it. What can be stated from the source is scope rather than mechanism. The defect is reachable through the KVM/zPCI interrupt path, which means the actors positioned to interact with it are those able to drive guest or host-side PCI interrupt configuration on an s390x hypervisor, not remote unauthenticated users on an ordinary web-facing server. A tracking bug, BZ-2517006, accompanies the CVE, and Red Hat notes in the advisory that a CVSS base score for the issue is held on the CVE page rather than in the errata itself. Because the kernel is the running core of the operating system, the update only becomes effective once the affected system is rebooted into the new build, a detail Red Hat states explicitly in its solution section.
The strategic significance here is routine rather than urgent. FIRST EPSS places the probability of exploitation of CVE-2026-74515 in the next thirty days at 0.1 percent, and neither Red Hat nor any authoritative source supplied with this advisory reports exploitation in the wild, a public proof of concept, or ransomware interest. The realistic consequence of leaving the flaw unpatched is confined to the virtualisation layer on mainframe-class hardware, where mishandled interrupt state can undermine the isolation and stability guarantees that make consolidated KVM hosting attractive in the first place for banks, insurers and government workloads that still run on IBM Z. A secondary consideration is the reboot requirement, which places this update in the change-window queue rather than on the emergency path, and in practice means estates with long-lived hypervisors may carry the vulnerable kernel for weeks after the fix is available. Red Hat also makes a broader point in this errata that applies to the whole kernel stream: it treats every kernel bug as potentially security-relevant, and patches shipped today may receive a retroactive CVE assignment later, which is why kernel updates are not safely deferred on the grounds that a given advisory looks quiet. For a Malaysian SOC on shift, this is a Monday item for most environments and a planned maintenance item for s390x KVM operators, not an overnight response.
Attack Surface
Server OS, Infrastructure, Endpoint OS
Tactics
Privilege Escalation, Impact
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Update the kernel package on all Red Hat Enterprise Linux 8 and 8.10 ELS systems to kernel-4.18.0-553.179.1.el8_10 (dnf update kernel), which carries the fix for CVE-2026-74515, then reboot — Red Hat states the update only takes effect after a reboot.
- Prioritise s390x hosts first: IBM Z and LinuxONE systems running KVM guests with zPCI device passthrough are where the vulnerable adapter interrupt forwarding path in the s390 KVM PCI code is actually reachable.
- Confirm remediation on each host with uname -r and rpm -q kernel-core, and treat any host still reporting a build earlier than 4.18.0-553.179.1.el8_10 as outstanding in the change record.
- Validate downloaded packages against the SHA-256 digests published in RHSA-2026:89816 before deployment, for example 9394a6d83ff637d33147909cd9a96c73544dec51f6791d20405fe096f7e1e86d for kernel-4.18.0-553.179.1.el8_10.src.rpm and 82c5833eb0aff7e070e96a2fe1d62323d51509a2bc14d0ededa38236cd6f3542 for the x86_64 kernel RPM.
- Use the Red Hat Lightspeed patch analysis view linked from the errata, or a Satellite errata report filtered on RHSA-2026:89816, to produce the authoritative list of affected hosts rather than relying on manual inventory.
- For RHEL 8.10 Extended Life Cycle Support estates on x86_64, aarch64, ppc64le and s390x, verify the ELS repositories are enabled (subscription-manager repos –list-enabled) so the 553.179.1 build is actually offered by dnf.
- Restrict and log administrative access to zPCI and KVM guest device configuration on s390x hypervisors, and alert on kernel oops or call traces referencing kvm-s390 or zpci in /var/log/messages and journalctl -k on hosts awaiting the reboot.
